@vunexa/lixa 0.1.4 → 0.1.6-alpha.10

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (27) hide show
  1. package/README.md +530 -15
  2. package/README.template.md +288 -44
  3. package/dist/dao/session-cache.d.ts +2 -1
  4. package/dist/dao/session-cache.d.ts.map +1 -1
  5. package/dist/dao/state-cache.d.ts +4 -0
  6. package/dist/dao/state-cache.d.ts.map +1 -1
  7. package/dist/dao/types.d.ts +68 -75
  8. package/dist/dao/types.d.ts.map +1 -1
  9. package/dist/errors.d.ts +90 -0
  10. package/dist/errors.d.ts.map +1 -0
  11. package/dist/export-types/index.d.ts +435 -107
  12. package/dist/index.cjs +590 -95
  13. package/dist/index.cjs.map +1 -1
  14. package/dist/index.d.cts +411 -108
  15. package/dist/index.d.ts +3 -1
  16. package/dist/index.d.ts.map +1 -1
  17. package/dist/index.js +569 -94
  18. package/dist/index.js.map +1 -1
  19. package/dist/lixa.d.ts +57 -21
  20. package/dist/lixa.d.ts.map +1 -1
  21. package/dist/models/session.d.ts +17 -11
  22. package/dist/models/session.d.ts.map +1 -1
  23. package/dist/types.d.ts +39 -1
  24. package/dist/types.d.ts.map +1 -1
  25. package/dist/utils/cookies.d.ts +142 -0
  26. package/dist/utils/cookies.d.ts.map +1 -0
  27. package/package.json +1 -1
package/dist/index.cjs.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"sources":["../src/index.ts","../src/lixa.ts","../src/types.ts","../src/dao/state-cache.ts","../src/dao/session-cache.ts","../src/utils/user-info.ts"],"sourcesContent":["/**\n * A flexible, provider-agnostic OAuth 2.0 and OpenID Connect (OIDC) client library for backend applications.\n * \n * @remarks\n * This package simplifies multi-provider authentication flows (e.g., Google, GitHub), supports extensible session management, and enables custom provider registration.\n * \n * Key features:\n * - OAuth 2.0 authorization code flow with PKCE (RFC 6749, RFC 7636)\n * - OpenID Connect support\n * - Built-in providers available in \\@vunexa/lixa-providers\n * - Custom provider support via IProvider interface\n * - Extensible session management via SessionDao.CreateSession\n * - Pluggable state and session storage via StateDao and SessionDao\n * - TypeScript-first with comprehensive type safety\n * \n * @packageDocumentation\n */\n\nexport { Lixa } from \"./lixa\";\nexport {\n type ProviderConfig,\n type LixaConfig,\n type SafeLixaConfig,\n type IProvider,\n type Session,\n type ConnectedResource,\n type ProviderMetadata,\n type OAuthTokenResponse,\n type StateHandler,\n type StateStorage,\n type SessionHandler,\n type SessionStorage,\n type StateData,\n AccountLinkingStrategy,\n type AccountLinkingMode,\n type AccountLinkingConfig,\n} from \"./types\";\nexport {\n type UserInfo,\n extractUserInfo,\n decodeIdToken,\n fetchUserInfo,\n determineProviderFromIssuer,\n} from \"./utils/user-info\";\n","import { randomBytes } from \"crypto\";\nimport { AccountLinkingStrategy, type LixaConfig, type ProviderConfig } from \"./types\";\nimport { IProvider } from \"./providers\";\nimport { LocalStateHandler } from \"./dao/state-cache\";\nimport { SessionHandler, StateHandler } from \"./dao/types\";\nimport crypto from \"crypto\";\nimport { LocalSessionHandler } from \"./dao/session-cache\";\nimport { type Session, type ConnectedResource, type OAuthTokenResponse, type ProviderMetadata } from \"./models/session\";\nimport { extractUserInfo, type UserInfo } from \"./utils/user-info\";\n\n/**\n * Type representing the keys of configured providers\n */\ntype ConfiguredProviderKey<T extends LixaConfig<Record<string, ProviderConfig>>> = keyof T['providers'];\n\n/**\n * A flexible, provider-agnostic OAuth 2.0 and OpenID Connect (OIDC) client library.\n *\n * @remarks\n * Lixa simplifies multi-provider authentication flows and supports extensible session management.\n * Providers can be passed inline in the configuration, eliminating the need for pre-registration.\n *\n * @example\n * Using built-in providers from \\@vunexa/lixa-providers:\n * ```typescript\n * import { Lixa } from '@vunexa/lixa';\n * import { GoogleProvider } from '@vunexa/lixa-providers';\n * \n * const lixa = new Lixa({\n * providers: {\n * google: {\n * provider: new GoogleProvider(),\n * clientId: 'your-client-id',\n * clientSecret: 'your-client-secret',\n * redirectUri: 'https://yourapp.com/auth/google/callback',\n * scopes: ['openid', 'email', 'profile']\n * }\n * }\n * });\n * ```\n * \n * @example\n * Using custom inline providers:\n * ```typescript\n * import { Lixa, IProvider } from '@vunexa/lixa';\n * \n * const customProvider: IProvider = {\n * authorizationEndpoint: 'https://custom.com/oauth/authorize',\n * tokenEndpoint: 'https://custom.com/oauth/token',\n * userInfoEndpoint: 'https://custom.com/api/user'\n * };\n * \n * const lixa = new Lixa({\n * providers: {\n * custom: {\n * provider: customProvider,\n * clientId: 'your-client-id',\n * clientSecret: 'your-client-secret',\n * redirectUri: 'https://yourapp.com/auth/custom/callback',\n * scopes: ['read:user']\n * }\n * }\n * });\n * ```\n *\n * @public\n */\nclass Lixa<TConfig extends LixaConfig<Record<string, ProviderConfig>> = LixaConfig> {\n private static DEFAULT_PROVIDERS: Map<string, IProvider> = new Map();\n private static CONFIGURED_PROVIDERS: Map<string, IProvider> = new Map(); // Legacy registry for backward compatibility\n private static LOCAL_STATE_HANDLER = new LocalStateHandler();\n private static LOCAL_SESSION_HANDLER = new LocalSessionHandler();\n private config: TConfig;\n private stateHandler: StateHandler;\n private sessionHandler: SessionHandler;\n private debug: boolean;\n\n /**\n * Creates a new Lixa instance with the provided configuration.\n * \n * @remarks\n * Providers can be passed inline in the configuration using the `provider` field.\n * Provider resolution priority: inline custom provider \\> default providers \\> legacy registry.\n * \n * @param config - The configuration object containing provider settings and optional session strategy\n * \n * @throws Error when provider configuration is missing required fields\n * @throws Error when provider implementation is missing required properties\n * @throws Error when provider is not available and no inline implementation is provided\n */\n constructor(config: TConfig) {\n this.config = config;\n this.stateHandler = config.stateHandler || Lixa.LOCAL_STATE_HANDLER;\n this.sessionHandler = config.sessionHandler || Lixa.LOCAL_SESSION_HANDLER;\n this.debug = config.debug || false;\n \n this.log('INFO', 'Init', 'Initializing Lixa instance', { \n providers: Object.keys(config.providers),\n debug: this.debug \n });\n \n // Validate and extract providers from configuration\n for (const [providerName, providerConfig] of Object.entries(config.providers)) {\n const name = providerName.toLowerCase();\n const typedConfig: ProviderConfig = providerConfig;\n \n // Validate provider configuration has required credentials\n this.validateProviderConfig(providerName, typedConfig);\n \n // If provider config includes a custom provider implementation, validate it\n if (typedConfig.provider) {\n this.validateProviderImplementation(providerName, typedConfig.provider);\n this.log('INFO', 'Init', `Registered inline provider: ${providerName}`);\n } else {\n // Check if it's available in default providers or legacy registry\n if (!Lixa.DEFAULT_PROVIDERS.has(name) && !Lixa.CONFIGURED_PROVIDERS.has(name)) {\n this.log('ERROR', 'Init', `Provider '${providerName}' not available`);\n throw new Error(\n `Provider '${providerName}' is not available. ` +\n `Either import it from '@vunexa/lixa-providers' and include it in the configuration, ` +\n `or provide a custom implementation using the 'provider' field: ` +\n `{ provider: new CustomProvider(), clientId: '...', ... }`\n );\n }\n this.log('INFO', 'Init', `Using registered provider: ${providerName}`);\n }\n }\n \n this.log('INFO', 'Init', 'Lixa instance initialized successfully');\n }\n \n /**\n * Validates that a provider configuration has all required credentials.\n * \n * @param name - The provider name\n * @param config - The provider configuration\n * @throws Error when required fields are missing or invalid\n */\n private validateProviderConfig(name: string, config: ProviderConfig): void {\n const requiredFields: (keyof ProviderConfig)[] = ['clientId', 'clientSecret', 'redirectUri', 'scopes'];\n const missingFields = requiredFields.filter(field => {\n const value = config[field];\n return value === undefined || value === null || (typeof value === 'string' && value.trim() === '');\n });\n \n if (missingFields.length > 0) {\n throw new Error(\n `Provider '${name}' configuration is missing required fields: ${missingFields.join(', ')}`\n );\n }\n \n // Validate scopes is an array\n if (!Array.isArray(config.scopes)) {\n throw new Error(\n `Provider '${name}' configuration error: 'scopes' must be an array of strings`\n );\n }\n \n if (config.scopes.length === 0) {\n throw new Error(\n `Provider '${name}' configuration error: 'scopes' array cannot be empty`\n );\n }\n }\n \n /**\n * Validates that a provider implementation has all required properties.\n * \n * @param name - The provider name\n * @param provider - The provider implementation\n * @throws Error when required properties are missing\n */\n private validateProviderImplementation(name: string, provider: IProvider): void {\n const requiredProps: (keyof IProvider)[] = ['authorizationEndpoint', 'tokenEndpoint', 'userInfoEndpoint'];\n const missingProps = requiredProps.filter(prop => {\n const value = provider[prop];\n return !value || typeof value !== 'string' || value.trim() === '';\n });\n \n if (missingProps.length > 0) {\n throw new Error(\n `Provider '${name}' implementation is missing required properties: ${missingProps.join(', ')}. ` +\n `All IProvider implementations must define: authorizationEndpoint, tokenEndpoint, and userInfoEndpoint.`\n );\n }\n }\n\n /**\n * Structured debug logging with standardized format.\n * \n * @param level - Log level (INFO, WARN, ERROR)\n * @param context - Context of the log (Init, Auth, Token, Session, State)\n * @param message - Log message\n * @param data - Optional data to log\n * \n * @remarks\n * Format: [Lixa] [timestamp] [level] [context] message\n * Only logs when debug mode is enabled.\n */\n private log(level: 'INFO' | 'WARN' | 'ERROR', context: 'Init' | 'Auth' | 'Token' | 'Session' | 'State' | 'AccountLinking', message: string, data?: Record<string, string | number | boolean | string[]>): void {\n if (!this.debug) return;\n \n const timestamp = new Date().toISOString();\n const prefix = `[Lixa] [${timestamp}] [${level}] [${context}]`;\n \n if (data !== undefined) {\n console.log(`${prefix} ${message}`, data);\n } else {\n console.log(`${prefix} ${message}`);\n }\n }\n\n /**\n * Checks if a provider is configured for this instance.\n * This is a type guard that narrows the provider type for use with getAuthUrl.\n *\n * @param provider - The provider name to check (case-insensitive)\n * @returns True if the provider is configured, false otherwise\n *\n * @example\n * ```typescript\n * if (lixa.isProviderConfigured(provider)) {\n * // TypeScript now knows provider is a valid ConfiguredProviderKey\n * const authUrl = lixa.getAuthUrl(provider, state);\n * }\n * ```\n */\n public isProviderConfigured<T extends string>(provider: T): provider is T & ConfiguredProviderKey<TConfig> {\n const providerType = provider.toLowerCase();\n return this.config.providers.hasOwnProperty(providerType);\n }\n \n /**\n * Gets a provider implementation by name.\n * Resolution priority: inline custom provider \\> default providers \\> legacy registry\n * \n * @param name - The provider name (case-insensitive)\n * @param config - The provider configuration\n * @returns The provider implementation\n * @throws Error when provider is not found\n */\n private getProvider(name: string, config: ProviderConfig): IProvider {\n // First check if provider is inline in config\n if (config.provider) {\n return config.provider;\n }\n \n // Then check default providers\n const lowerName = name.toLowerCase();\n const defaultProvider = Lixa.DEFAULT_PROVIDERS.get(lowerName);\n if (defaultProvider) {\n return defaultProvider;\n }\n \n // Finally check legacy registry for backward compatibility\n const legacyProvider = Lixa.CONFIGURED_PROVIDERS.get(lowerName);\n if (legacyProvider) {\n return legacyProvider;\n }\n \n throw new Error(\n `Provider '${name}' not found. ` +\n `Ensure the provider is included in the configuration with a 'provider' field, ` +\n `or registered using Lixa.registerProvider().`\n );\n }\n\n /**\n * Registers custom OAuth providers for use with Lixa.\n * \n * @deprecated This method is maintained for backward compatibility.\n * The recommended approach is to pass providers inline in the configuration:\n * ```typescript\n * const lixa = new Lixa({\n * providers: {\n * custom: {\n * provider: new CustomProvider(),\n * clientId: '...',\n * // ...\n * }\n * }\n * });\n * ```\n *\n * @param providerMap - A map of provider names to IProvider implementations\n *\n * @example\n * Legacy usage (still supported):\n * ```typescript\n * class CustomProvider implements IProvider {\n * authorizationEndpoint = 'https://custom.com/oauth/authorize';\n * tokenEndpoint = 'https://custom.com/oauth/token';\n * userInfoEndpoint = 'https://custom.com/api/user';\n * }\n *\n * Lixa.registerProvider({ custom: new CustomProvider() });\n * ```\n */\n public static registerProvider<T extends Record<string, IProvider>>(providerMap: T): void {\n Object.entries(providerMap).forEach(([key, providerImpl]) => {\n Lixa.CONFIGURED_PROVIDERS.set(key.toLowerCase(), providerImpl);\n });\n }\n\n /**\n * Gets the list of registered provider names.\n * \n * @returns Array of registered provider names\n */\n public static getRegisteredProviders(): string[] {\n return Array.from(Lixa.CONFIGURED_PROVIDERS.keys());\n }\n\n /**\n * Creates a type-safe configuration.\n * \n * @deprecated This method is maintained for backward compatibility.\n * You can now pass configuration directly to the Lixa constructor without this helper.\n * \n * @param config - Configuration object with provider settings\n * @returns The same configuration object with type safety\n * \n * @example\n * New approach (recommended):\n * ```typescript\n * const lixa = new Lixa({\n * providers: {\n * google: {\n * provider: new GoogleProvider(),\n * clientId: '...',\n * // ...\n * }\n * }\n * });\n * ```\n */\n public static createConfig<T extends Record<string, ProviderConfig>>(\n config: LixaConfig<T> & { providers: T }\n ): LixaConfig<T> {\n return config;\n }\n\n /**\n * Generates a cryptographically secure random state parameter for OAuth flows.\n *\n * @returns A 32-character hexadecimal string\n *\n * @remarks\n * The state parameter is used to prevent CSRF attacks in OAuth flows.\n */\n public static generateRandomState(): string {\n return randomBytes(16).toString(\"hex\");\n }\n\n /**\n * Generates a cryptographically secure code verifier for PKCE flows.\n *\n * @returns A 64-character hexadecimal string (32 random bytes encoded as hex)\n *\n * @remarks\n * This method implements the code verifier generation as specified in RFC 7636 (PKCE).\n * \n * **PKCE (Proof Key for Code Exchange)** is a security extension to OAuth 2.0 that\n * prevents authorization code interception attacks. It's especially important for\n * public clients (mobile apps, SPAs) but is recommended for all OAuth flows.\n * \n * **Generation methodology:**\n * 1. Generate 32 cryptographically random bytes using Node.js crypto.randomBytes()\n * 2. Encode the bytes as a hexadecimal string (64 characters)\n * 3. The verifier is stored securely and used later in the token exchange\n * \n * **RFC 7636 Requirements:**\n * - Minimum length: 43 characters\n * - Maximum length: 128 characters\n * - Character set: [A-Z] / [a-z] / [0-9] / \"-\" / \".\" / \"_\" / \"~\"\n * - This implementation produces 64 hex characters, meeting the requirements\n * \n * The code verifier is:\n * - Generated when creating the authorization URL\n * - Stored in state cache with the state parameter\n * - Retrieved during callback handling\n * - Sent to the token endpoint to prove the client's identity\n * \n * @see {@link https://datatracker.ietf.org/doc/html/rfc7636 | RFC 7636 - PKCE}\n * @see buildCodeChallenge for the corresponding challenge generation\n * \n * @internal\n */\n private static generateCodeVerifier(): string {\n return randomBytes(32).toString(\"hex\");\n }\n\n /**\n * Generates a code challenge from a code verifier for PKCE flows.\n *\n * @param codeVerifier - The code verifier string (64 hex characters)\n * @returns A base64url-encoded SHA-256 hash of the code verifier\n *\n * @remarks\n * This method implements the code challenge generation as specified in RFC 7636 (PKCE)\n * using the S256 (SHA-256) transformation method.\n * \n * **Challenge generation methodology:**\n * 1. Hash the code verifier using SHA-256\n * 2. Encode the hash as base64\n * 3. Convert to base64url format (RFC 4648):\n * - Replace '+' with '-'\n * - Replace '/' with '_'\n * - Remove trailing '=' padding\n * \n * **PKCE Flow:**\n * 1. Client generates code_verifier (random string)\n * 2. Client creates code_challenge = BASE64URL(SHA256(code_verifier))\n * 3. Client sends code_challenge to authorization endpoint\n * 4. Authorization server stores the code_challenge\n * 5. Client sends code_verifier to token endpoint\n * 6. Authorization server verifies: SHA256(code_verifier) == code_challenge\n * \n * **Security Benefits:**\n * - Prevents authorization code interception attacks\n * - Even if an attacker intercepts the authorization code, they cannot\n * exchange it for tokens without the original code_verifier\n * - The challenge is sent in the authorization request (public)\n * - The verifier is sent in the token request (should be kept secret)\n * \n * **RFC 7636 Transformation Methods:**\n * - plain: code_challenge = code_verifier (not recommended)\n * - S256: code_challenge = BASE64URL(SHA256(code_verifier)) (recommended, used here)\n * \n * @see {@link https://datatracker.ietf.org/doc/html/rfc7636 | RFC 7636 - PKCE}\n * @see {@link https://datatracker.ietf.org/doc/html/rfc4648#section-5 | RFC 4648 - Base64url Encoding}\n * @see generateCodeVerifier for the verifier generation\n * \n * @internal\n */\n private static buildCodeChallenge(codeVerifier: string): string {\n const hash = crypto\n .createHash(\"sha256\")\n .update(codeVerifier)\n .digest(\"base64\");\n\n // Convert to base64url (RFC 4648 Section 5)\n return hash.replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n }\n\n /**\n * Generates the authorization URL for the specified provider.\n *\n * @param provider - The provider name (must be a configured provider key)\n * @param state - The state parameter for CSRF protection\n * @returns The complete authorization URL to redirect users to\n *\n * @throws Error when the provider is not configured\n *\n * @example\n * ```typescript\n * const state = Lixa.generateRandomState();\n * const authUrl = lixa.getAuthUrl('google', state);\n * res.redirect(authUrl);\n * ```\n */\n public async getAuthUrl(provider: ConfiguredProviderKey<TConfig> | string, state?: string): Promise<string> {\n const providerType = String(provider).toLowerCase();\n \n this.log('INFO', 'Auth', `Generating authorization URL for provider: ${providerType}`);\n \n const providerConfig = this.findProviderByType(providerType);\n\n if (!providerConfig) {\n this.log('ERROR', 'Auth', `Provider '${String(provider)}' is not configured`);\n throw new Error(`Provider '${String(provider)}' is not configured in this Lixa instance`);\n }\n\n const providerImpl = this.getProvider(providerType, providerConfig);\n\n // Generate state and code verifier\n let stateValue: string;\n let codeVerifier: string;\n \n if (this.stateHandler.generateState) {\n this.log('INFO', 'State', 'Calling custom GenerateState');\n const generated = await this.stateHandler.generateState(providerType);\n stateValue = state || generated.state;\n codeVerifier = generated.data.codeVerifier;\n \n // Save the generated state data\n const storage = this.stateHandler.stateStorage || Lixa.LOCAL_STATE_HANDLER.stateStorage!;\n await storage.saveState(stateValue, generated.data, 300);\n } else {\n this.log('INFO', 'State', 'Using default state generation');\n stateValue = state || randomBytes(16).toString(\"hex\");\n codeVerifier = randomBytes(32).toString(\"hex\");\n \n // Save state with default implementation\n const storage = this.stateHandler.stateStorage || Lixa.LOCAL_STATE_HANDLER.stateStorage!;\n await storage.saveState(\n stateValue,\n {\n createdAt: Date.now(),\n provider: providerType,\n codeVerifier,\n },\n 300 // 5 minutes in seconds\n );\n }\n\n const codeChallenge = Lixa.buildCodeChallenge(codeVerifier);\n\n this.log('INFO', 'State', `Saved state for provider: ${providerType}`, { state: stateValue });\n\n const authNScopes = this.resolveAuthNScopes(providerType, providerConfig.scopes, providerImpl);\n\n const params = new URLSearchParams({\n client_id: providerConfig.clientId,\n redirect_uri: providerConfig.redirectUri,\n scope: authNScopes.join(\" \"),\n state: stateValue,\n response_type: \"code\",\n code_challenge: codeChallenge,\n code_challenge_method: \"S256\",\n ...providerConfig.extraConfig,\n });\n\n const authUrl = `${providerImpl.authorizationEndpoint}?${params.toString()}`;\n this.log('INFO', 'Auth', `Authorization URL generated successfully`, { \n provider: providerType,\n endpoint: providerImpl.authorizationEndpoint \n });\n\n return authUrl;\n }\n\n /**\n * Restricts primary authentication scopes strictly to AuthN identity scopes.\n */\n private resolveAuthNScopes(\n providerType: string,\n configuredScopes: string[],\n providerImpl: IProvider\n ): string[] {\n const defaultAuthScopes: Record<string, string[]> = {\n google: [\"openid\", \"email\", \"profile\"],\n github: [\"read:user\", \"user:email\"],\n microsoft: [\"openid\", \"email\", \"profile\"],\n };\n\n const standardAuthNScopes = [\n \"openid\",\n \"email\",\n \"profile\",\n \"read:user\",\n \"user:email\",\n \"read:email\",\n \"user:profile\",\n \"user\",\n ];\n\n const allowedAuthNScopes = new Set<string>([\n ...standardAuthNScopes,\n ...(providerImpl.authScopes || []),\n ...(defaultAuthScopes[providerType] || []),\n ]);\n\n const validAuthNScopes = (configuredScopes || []).filter((scope) => allowedAuthNScopes.has(scope));\n const nonAuthNScopes = (configuredScopes || []).filter((scope) => !allowedAuthNScopes.has(scope));\n\n if (nonAuthNScopes.length > 0) {\n this.log(\n \"WARN\",\n \"Auth\",\n `Primary authentication is strictly limited to AuthN scopes. Excluded non-AuthN resource scopes: [${nonAuthNScopes.join(\n \", \"\n )}]. Use lixa.getResourceAuthUrl() post-login to connect resource providers.`\n );\n }\n\n if (validAuthNScopes.length > 0) {\n return validAuthNScopes;\n }\n\n return providerImpl.authScopes || defaultAuthScopes[providerType] || [\"openid\", \"email\", \"profile\"];\n }\n\n /**\n * Handles the OAuth callback and creates a user session.\n *\n * @param provider - The provider name (must be a configured provider key)\n * @param code - The authorization code from the provider\n * @param state - The state parameter for validation\n * @returns A Promise that resolves to the session ID\n *\n * @throws Error when code or state is missing/invalid, or provider is not configured\n *\n * @example\n * ```typescript\n * const sessionId = await lixa.handleCallback({\n * provider: 'google',\n * code: req.query.code,\n * state: req.query.state\n * });\n * ```\n */\n public async handleCallback({\n provider,\n code,\n state,\n }: {\n provider: ConfiguredProviderKey<TConfig> | string;\n code: string;\n state?: string;\n }): Promise<string> {\n const providerType = String(provider).toLowerCase();\n this.log('INFO', 'Auth', `Handling OAuth callback for provider: ${providerType}`);\n\n if (!code || code.trim() === \"\") {\n this.log('ERROR', 'Auth', 'Invalid or missing authorization code in callback');\n throw new Error(\"Invalid or missing code in callback\");\n }\n\n if (!state || state.trim() === \"\") {\n this.log('ERROR', 'Auth', 'Invalid or missing state in callback');\n throw new Error(\"Invalid or missing state in callback\");\n }\n\n this.log('INFO', 'State', 'Validating state parameter', { state });\n\n //Validate state here\n const stateStorage = this.stateHandler.stateStorage || Lixa.LOCAL_STATE_HANDLER.stateStorage!;\n const cachedState = await stateStorage.getState(state);\n if (!cachedState) {\n this.log('ERROR', 'State', 'State validation failed: state not found or expired', { state });\n throw new Error(\"Invalid or expired state\");\n }\n \n this.log('INFO', 'State', 'State validated successfully, removing from cache');\n // State is valid, remove it from cache to prevent reuse\n await stateStorage.deleteState(state);\n\n //Get code verifier from cached state\n const codeVerifier = cachedState.codeVerifier;\n\n const providerConfig = this.findProviderByType(providerType);\n\n if (!providerConfig) {\n this.log('ERROR', 'Auth', `Provider '${String(provider)}' is not configured`);\n throw new Error(`Provider '${String(provider)}' is not configured in this Lixa instance`);\n }\n\n const providerImpl = this.getProvider(providerType, providerConfig);\n\n this.log('INFO', 'Token', `Exchanging authorization code for tokens`, { provider: providerType });\n\n // Exchange code for tokens and fetch user info here.\n const tokens = await this.exchangeCodeForToken(\n code,\n providerConfig,\n providerImpl,\n codeVerifier\n );\n\n this.log('INFO', 'Token', 'Token exchange successful');\n this.log('INFO', 'Session', 'Generating user session');\n \n // Create provider metadata for session generation\n const providerMetadata: ProviderMetadata = {\n name: providerType,\n endpoints: {\n authorization: providerImpl.authorizationEndpoint,\n token: providerImpl.tokenEndpoint,\n userInfo: providerImpl.userInfoEndpoint\n }\n };\n\n // Extract user info if possible for account linking & session population\n let extractedUserInfo: UserInfo | undefined;\n try {\n const { userInfo } = await extractUserInfo(tokens, providerMetadata);\n extractedUserInfo = userInfo;\n } catch {\n // User info extraction might fail if scopes are limited or provider requires special handling\n }\n \n // Generate session data\n const generateSession = this.sessionHandler.generateSession || Lixa.LOCAL_SESSION_HANDLER.GenerateSession!.bind(Lixa.LOCAL_SESSION_HANDLER);\n \n if (this.sessionHandler.generateSession) {\n this.log('INFO', 'Session', 'Calling custom GenerateSession');\n } else {\n this.log('INFO', 'Session', 'Using default session generation');\n }\n \n const session = await generateSession(tokens, providerMetadata);\n session.provider = session.provider || providerType;\n if (extractedUserInfo?.email && !session.email) {\n session.email = extractedUserInfo.email;\n }\n\n const sessionStorage = this.sessionHandler.sessionStorage || Lixa.LOCAL_SESSION_HANDLER.sessionStorage!;\n\n // Account Linking Mode: AccountLinkingStrategy.AUTO_LINK_BY_VERIFIED_EMAIL\n const linkingConfig = this.config.accountLinking;\n const mode = String(linkingConfig?.mode || \"\");\n const isLinkByEmail =\n mode === AccountLinkingStrategy.AUTO_LINK_BY_VERIFIED_EMAIL ||\n mode === \"AUTO_LINK_BY_VERIFIED_EMAIL\" ||\n mode === \"linkByEmail\";\n const email = extractedUserInfo?.email;\n const isVerified = extractedUserInfo?.email_verified !== false;\n const requireVerified = linkingConfig?.requireVerifiedEmail ?? true;\n const canLink = isLinkByEmail && email && (!requireVerified || isVerified);\n\n if (canLink && sessionStorage.getSessionByEmail) {\n const existingRecord = await sessionStorage.getSessionByEmail(email);\n if (existingRecord) {\n this.log('INFO', 'AccountLinking', `Linking provider '${providerType}' to existing session for email '${email}'`);\n const { sessionId: existingSessionId, session: existingSession } = existingRecord;\n \n existingSession.accounts = existingSession.accounts || {};\n existingSession.accounts[providerType] = {\n provider: providerType,\n providerUserId: extractedUserInfo?.sub || extractedUserInfo?.id,\n email,\n accessToken: tokens.access_token,\n raw: tokens,\n linkedAt: Date.now(),\n };\n existingSession.provider = providerType;\n existingSession.token = tokens.access_token;\n existingSession.raw = tokens;\n\n await sessionStorage.saveSession(existingSessionId, existingSession, 86400);\n return existingSessionId;\n }\n }\n\n // Default / Separate Account Mode\n session.accounts = session.accounts || {};\n session.accounts[providerType] = {\n provider: providerType,\n providerUserId: extractedUserInfo?.sub || extractedUserInfo?.id,\n email: extractedUserInfo?.email,\n accessToken: tokens.access_token,\n raw: tokens,\n linkedAt: Date.now(),\n };\n\n // Generate unique session ID\n const sessionId = randomBytes(32).toString(\"hex\");\n session.id = sessionId;\n\n this.log('INFO', 'Session', 'Storing session', { sessionId });\n await sessionStorage.saveSession(sessionId, session, 86400);\n\n this.log('INFO', 'Session', 'Session created successfully', { sessionId });\n\n return sessionId;\n }\n\n /**\n * Explicitly link a new OAuth provider account to an active session.\n * \n * @param params - Object containing sessionId, provider, code, and optional state\n * @returns The active session ID with the newly linked provider\n */\n public async linkAccount(params: {\n sessionId: string;\n provider: ConfiguredProviderKey<TConfig> | string;\n code: string;\n state?: string;\n }): Promise<string> {\n const { sessionId, provider, code, state } = params;\n const sessionStorage = this.sessionHandler.sessionStorage || Lixa.LOCAL_SESSION_HANDLER.sessionStorage!;\n const existingSession = await sessionStorage.getSession(sessionId);\n\n if (!existingSession) {\n throw new Error(\"Invalid session ID. User must be authenticated to link an account.\");\n }\n\n const providerType = String(provider).toLowerCase();\n const providerConfig = this.findProviderByType(providerType);\n if (!providerConfig) {\n throw new Error(`Provider '${String(provider)}' is not configured`);\n }\n const providerImpl = this.getProvider(providerType, providerConfig);\n\n // Get code verifier if state is provided\n let codeVerifier = randomBytes(32).toString(\"hex\");\n if (state) {\n const stateStorage = this.stateHandler.stateStorage || Lixa.LOCAL_STATE_HANDLER.stateStorage!;\n const cachedState = await stateStorage.getState(state);\n if (cachedState) {\n codeVerifier = cachedState.codeVerifier;\n await stateStorage.deleteState(state);\n }\n }\n\n const tokens = await this.exchangeCodeForToken(providerType, providerConfig, providerImpl, codeVerifier);\n\n const providerMetadata: ProviderMetadata = {\n name: providerType,\n endpoints: {\n authorization: providerImpl.authorizationEndpoint,\n token: providerImpl.tokenEndpoint,\n userInfo: providerImpl.userInfoEndpoint,\n },\n };\n\n let extractedUserInfo: UserInfo | undefined;\n try {\n const { userInfo } = await extractUserInfo(tokens, providerMetadata);\n extractedUserInfo = userInfo;\n } catch {\n // User info extraction optional\n }\n\n existingSession.accounts = existingSession.accounts || {};\n existingSession.accounts[providerType] = {\n provider: providerType,\n providerUserId: extractedUserInfo?.sub || extractedUserInfo?.id,\n email: extractedUserInfo?.email,\n accessToken: tokens.access_token,\n raw: tokens,\n linkedAt: Date.now(),\n };\n\n if (extractedUserInfo?.email && !existingSession.email) {\n existingSession.email = extractedUserInfo.email;\n }\n\n await sessionStorage.saveSession(sessionId, existingSession, 86400);\n return sessionId;\n }\n\n /**\n * Unlinks an OAuth provider account from an active session.\n * \n * @param sessionId - Active session ID\n * @param providerToUnlink - Provider name to unlink (e.g. 'github')\n * @returns Promise resolving to true on successful unlink\n */\n public async unlinkAccount(sessionId: string, providerToUnlink: string): Promise<boolean> {\n const sessionStorage = this.sessionHandler.sessionStorage || Lixa.LOCAL_SESSION_HANDLER.sessionStorage!;\n const session = await sessionStorage.getSession(sessionId);\n\n if (!session || !session.accounts) {\n throw new Error(\"Session not found or has no linked accounts.\");\n }\n\n const linkedProviders = Object.keys(session.accounts);\n if (linkedProviders.length <= 1) {\n throw new Error(\"Cannot unlink the only authentication provider for this account.\");\n }\n\n delete session.accounts[providerToUnlink.toLowerCase()];\n await sessionStorage.saveSession(sessionId, session, 86400);\n return true;\n }\n\n /**\n * Generates an authorization URL for connecting a resource provider (AuthZ) post-login.\n * \n * @remarks\n * Resource authorization is kept strictly separate from primary authentication (AuthN).\n * Call this method after a user is authenticated to request permissions for external API access\n * (e.g. GitHub repositories, Google Drive, Slack, etc.).\n * \n * @param params - Object containing sessionId, provider, requested resource scopes, and optional state\n * @returns The authorization URL for resource consent\n */\n public async getResourceAuthUrl(params: {\n sessionId: string;\n provider: ConfiguredProviderKey<TConfig> | string;\n scopes: string[];\n state?: string;\n prompt?: string;\n extraConfig?: Record<string, string>;\n }): Promise<string> {\n const { sessionId, provider, scopes, state, prompt, extraConfig } = params;\n const sessionStorage = this.sessionHandler.sessionStorage || Lixa.LOCAL_SESSION_HANDLER.sessionStorage!;\n const activeSession = await sessionStorage.getSession(sessionId);\n\n if (!activeSession) {\n throw new Error(\"Authentication required. Active session must exist to connect resource providers.\");\n }\n\n const providerType = String(provider).toLowerCase();\n const providerConfig = this.findProviderByType(providerType);\n if (!providerConfig) {\n throw new Error(`Provider '${String(provider)}' is not configured`);\n }\n\n const providerImpl = this.getProvider(providerType, providerConfig);\n const stateValue = state || randomBytes(16).toString(\"hex\");\n const codeVerifier = randomBytes(32).toString(\"hex\");\n\n const storage = this.stateHandler.stateStorage || Lixa.LOCAL_STATE_HANDLER.stateStorage!;\n await storage.saveState(\n stateValue,\n {\n createdAt: Date.now(),\n provider: providerType,\n codeVerifier,\n },\n 300\n );\n\n const codeChallenge = Lixa.buildCodeChallenge(codeVerifier);\n\n const searchParams = new URLSearchParams({\n client_id: providerConfig.clientId,\n redirect_uri: providerConfig.redirectUri,\n scope: scopes.join(\" \"),\n state: stateValue,\n response_type: \"code\",\n code_challenge: codeChallenge,\n code_challenge_method: \"S256\",\n ...(prompt ? { prompt } : {}),\n ...providerConfig.extraConfig,\n ...extraConfig,\n });\n\n return `${providerImpl.authorizationEndpoint}?${searchParams.toString()}`;\n }\n\n /**\n * Handles the OAuth callback for a connected resource provider and stores resource tokens on the session.\n * \n * @param params - Object containing sessionId, provider, code, state, and requested scopes\n * @returns Updated Session containing stored resource tokens under session.resources[provider]\n */\n public async handleResourceCallback(params: {\n sessionId: string;\n provider: ConfiguredProviderKey<TConfig> | string;\n code: string;\n state?: string;\n scopes?: string[];\n }): Promise<Session> {\n const { sessionId, provider, code, state, scopes } = params;\n const sessionStorage = this.sessionHandler.sessionStorage || Lixa.LOCAL_SESSION_HANDLER.sessionStorage!;\n const activeSession = await sessionStorage.getSession(sessionId);\n\n if (!activeSession) {\n throw new Error(\"Authentication required. Active session not found for resource connection.\");\n }\n\n const providerType = String(provider).toLowerCase();\n const providerConfig = this.findProviderByType(providerType);\n if (!providerConfig) {\n throw new Error(`Provider '${String(provider)}' is not configured`);\n }\n const providerImpl = this.getProvider(providerType, providerConfig);\n\n let codeVerifier = randomBytes(32).toString(\"hex\");\n if (state) {\n const stateStorage = this.stateHandler.stateStorage || Lixa.LOCAL_STATE_HANDLER.stateStorage!;\n const cachedState = await stateStorage.getState(state);\n if (cachedState) {\n codeVerifier = cachedState.codeVerifier;\n await stateStorage.deleteState(state);\n }\n }\n\n const tokens = await this.exchangeCodeForToken(code, providerConfig, providerImpl, codeVerifier);\n\n activeSession.resources = activeSession.resources || {};\n activeSession.resources[providerType] = {\n provider: providerType,\n accessToken: tokens.access_token,\n refreshToken: tokens.refresh_token,\n scopes: scopes || (tokens.scope ? tokens.scope.split(\" \") : []),\n raw: tokens,\n connectedAt: Date.now(),\n };\n\n await sessionStorage.saveSession(sessionId, activeSession, 86400);\n return activeSession;\n }\n\n /**\n * Retrieves a connected resource provider token for an active session.\n * \n * @param sessionId - Active session ID\n * @param provider - Provider identifier (e.g. 'github')\n */\n public async getConnectedResource(sessionId: string, provider: string): Promise<ConnectedResource | null> {\n const sessionStorage = this.sessionHandler.sessionStorage || Lixa.LOCAL_SESSION_HANDLER.sessionStorage!;\n const activeSession = await sessionStorage.getSession(sessionId);\n if (!activeSession || !activeSession.resources) return null;\n return activeSession.resources[provider.toLowerCase()] || null;\n }\n\n /**\n * Disconnects a resource provider from an active session.\n * \n * @param sessionId - Active session ID\n * @param provider - Provider identifier to disconnect\n */\n public async disconnectResource(sessionId: string, provider: string): Promise<boolean> {\n const sessionStorage = this.sessionHandler.sessionStorage || Lixa.LOCAL_SESSION_HANDLER.sessionStorage!;\n const activeSession = await sessionStorage.getSession(sessionId);\n if (!activeSession || !activeSession.resources) return false;\n delete activeSession.resources[provider.toLowerCase()];\n await sessionStorage.saveSession(sessionId, activeSession, 86400);\n return true;\n }\n\n public async fetchSessionInfo(sessionId: string): Promise<Session | null> {\n const sessionStorage = this.sessionHandler.sessionStorage || Lixa.LOCAL_SESSION_HANDLER.sessionStorage!;\n return await sessionStorage.getSession<Session>(sessionId);\n }\n\n private async exchangeCodeForToken(\n code: string,\n providerConfig: ProviderConfig,\n providerImpl: IProvider,\n codeVerifier: string\n ): Promise<OAuthTokenResponse> {\n // Build the request body\n const body: Record<string, string> = {\n client_id: providerConfig.clientId,\n client_secret: providerConfig.clientSecret,\n code,\n redirect_uri: providerConfig.redirectUri,\n grant_type: \"authorization_code\",\n };\n\n if (codeVerifier) {\n body.code_verifier = codeVerifier;\n }\n const params = new URLSearchParams(body);\n\n this.log('INFO', 'Token', 'Sending token exchange request', { \n endpoint: providerImpl.tokenEndpoint \n });\n \n const response = await fetch(providerImpl.tokenEndpoint, {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n Accept: \"application/json\",\n },\n body: params.toString(),\n });\n\n if (!response.ok) {\n const errorBody = await response.text();\n this.log('ERROR', 'Token', 'Token exchange failed', { \n status: response.status, \n statusText: response.statusText,\n error: errorBody \n });\n throw new Error(\n `Token exchange failed: ${response.status} ${response.statusText} - ${errorBody}`\n );\n }\n\n this.log('INFO', 'Token', 'Token exchange response received successfully');\n return response.json();\n }\n\n private findProviderByType(providerType: string): ProviderConfig | undefined {\n // Use Object.entries to safely iterate and find the provider\n for (const [key, value] of Object.entries(this.config.providers)) {\n if (key.toLowerCase() === providerType.toLowerCase()) {\n return value;\n }\n }\n return undefined;\n }\n}\n\nexport { Lixa };\n","import { SessionHandler, SessionStorage, StateHandler, StateStorage, StateData } from \"./dao/types\";\nimport { Session, ProviderMetadata } from \"./models/session\";\nimport { IProvider } from \"./providers/IProvider\";\n\n// Re-export types for external use\nexport { Session, ConnectedResource } from \"./models/session\";\nexport { ProviderMetadata };\nexport { OAuthTokenResponse } from \"./models/session\";\nexport { IProvider };\nexport { StateHandler };\nexport { StateStorage };\nexport { SessionHandler };\nexport { SessionStorage };\nexport { StateData };\n\n/**\n * Configuration for an OAuth provider instance.\n * \n * @remarks\n * For built-in providers (google, github), just provide credentials.\n * For custom providers, include the provider implementation.\n * \n * The provider field uses a discriminated union to ensure type safety:\n * - When omitted or undefined: assumes a built-in provider\n * - When provided: must be a valid IProvider implementation\n * \n * @example\n * Built-in provider configuration:\n * ```typescript\n * {\n * clientId: 'your-client-id',\n * clientSecret: 'your-client-secret',\n * redirectUri: 'https://app.com/callback',\n * scopes: ['openid', 'email']\n * }\n * ```\n * \n * @example\n * Custom provider configuration:\n * ```typescript\n * {\n * provider: new CustomProvider(),\n * clientId: 'your-client-id',\n * clientSecret: 'your-client-secret',\n * redirectUri: 'https://app.com/callback',\n * scopes: ['read:user']\n * }\n * ```\n *\n * @public\n */\nexport type ProviderConfig = {\n /** The OAuth client ID provided by the provider */\n clientId: string;\n \n /** The OAuth client secret provided by the provider */\n clientSecret: string;\n \n /** The redirect URI registered with the provider */\n redirectUri: string;\n \n /** Array of OAuth scopes to request */\n scopes: string[];\n \n /** Additional provider-specific configuration parameters */\n extraConfig?: Record<string, string>;\n} & (\n | { provider?: never } // Built-in provider (no provider field needed)\n | { provider: IProvider } // Custom provider (provider field required)\n);\n\n/**\n * Main configuration object for Lixa.\n * Provides type-safe provider name inference.\n * \n * @remarks\n * The generic type parameter TProviders enables TypeScript to infer provider names\n * from the configuration object, providing autocomplete and type checking for\n * provider names in methods like getAuthUrl() and handleCallback().\n * \n * @typeParam TProviders - The provider configuration map type, defaults to a generic record\n * \n * @example\n * Basic configuration with built-in providers:\n * ```typescript\n * import { Lixa } from '@vunexa/lixa';\n * import { GoogleProvider } from '@vunexa/lixa-providers';\n * \n * const lixa = new Lixa({\n * providers: {\n * google: {\n * provider: new GoogleProvider(),\n * clientId: process.env.GOOGLE_CLIENT_ID!,\n * clientSecret: process.env.GOOGLE_CLIENT_SECRET!,\n * redirectUri: 'https://app.com/auth/google/callback',\n * scopes: ['openid', 'email', 'profile']\n * }\n * }\n * });\n * ```\n * \n * @example\n * Configuration with custom session and state handlers:\n * ```typescript\n * const lixa = new Lixa({\n * providers: {\n * google: {\n * provider: new GoogleProvider(),\n * clientId: process.env.GOOGLE_CLIENT_ID!,\n * clientSecret: process.env.GOOGLE_CLIENT_SECRET!,\n * redirectUri: 'https://app.com/auth/google/callback',\n * scopes: ['openid', 'email', 'profile']\n * }\n * },\n * stateHandler: {\n * storage: {\n * saveState: async (state, data, ttl) => await redis.setex(state, ttl, JSON.stringify(data)),\n * getState: async (state) => JSON.parse(await redis.get(state) || 'null'),\n * deleteState: async (state) => await redis.del(state)\n * }\n * },\n * sessionHandler: {\n * GenerateSession: async (tokenData, providerMetadata) => {\n * const { userInfo } = await extractUserInfo(tokenData, providerMetadata);\n * const user = await db.users.upsert({ email: userInfo.email });\n * return { token: tokenData.access_token, raw: { ...tokenData, userId: user.id } };\n * },\n * storage: {\n * saveSession: async (id, session, ttl) => await db.sessions.create({ id, session, ttl }),\n * getSession: async (id) => await db.sessions.findOne({ id }),\n * deleteSession: async (id) => await db.sessions.delete({ id })\n * }\n * },\n * debug: true\n * });\n * ```\n *\n/**\n * Strategy mode for multi-SSO identity account linking.\n * \n * @public\n */\nexport enum AccountLinkingStrategy {\n /** Automatically merge identities matching the same verified primary email address */\n AUTO_LINK_BY_VERIFIED_EMAIL = \"AUTO_LINK_BY_VERIFIED_EMAIL\",\n\n /** Keep identity profiles isolated per provider (no automatic account merging) */\n ISOLATED = \"ISOLATED\",\n}\n\n/**\n * Supported mode values for account linking configuration.\n * \n * @public\n */\nexport type AccountLinkingMode =\n | AccountLinkingStrategy\n | \"AUTO_LINK_BY_VERIFIED_EMAIL\"\n | \"ISOLATED\"\n | \"linkByEmail\"\n | \"separate\";\n\n/**\n * Account linking settings for Lixa.\n * \n * @public\n */\nexport interface AccountLinkingConfig {\n /**\n * Account linking mode strategy:\n * - AccountLinkingStrategy.AUTO_LINK_BY_VERIFIED_EMAIL (\"AUTO_LINK_BY_VERIFIED_EMAIL\" / \"linkByEmail\"): Auto-link accounts sharing same verified email.\n * - AccountLinkingStrategy.ISOLATED (\"ISOLATED\" / \"separate\"): Keep provider accounts isolated (default).\n * \n * @default AccountLinkingStrategy.ISOLATED\n */\n mode?: AccountLinkingMode;\n\n /**\n * Whether to require that the email address is verified by the provider before linking.\n * \n * @default true\n */\n requireVerifiedEmail?: boolean;\n}\n\n/**\n * Main configuration object for Lixa.\n * Provides type-safe provider name inference.\n * \n * @public\n */\nexport interface LixaConfig<TProviders extends Record<string, ProviderConfig> = Record<string, ProviderConfig>> {\n /** \n * Map of provider names to their configurations.\n * Provider names will be available for autocomplete in getAuthUrl() and handleCallback().\n */\n providers: TProviders;\n\n /**\n * Account linking configuration for multi-SSO user linking.\n */\n accountLinking?: AccountLinkingConfig;\n /** \n * Optional custom state handler.\n * Handles state generation and storage during OAuth authorization flow.\n * \n * - GenerateState: Customizes how state parameters and PKCE verifiers are generated\n * - storage: Provides persistent state storage (save/get/delete operations)\n * \n * Defaults to in-memory cache if not provided (not suitable for production).\n * \n * @see {@link StateHandler}\n */\n stateHandler?: StateHandler;\n \n /** \n * Optional custom session handler.\n * Handles session generation and storage after authentication.\n * \n * - GenerateSession: Customizes how OAuth tokens are converted into session data\n * - storage: Provides persistent session storage (save/get/delete operations)\n * \n * Defaults to in-memory cache if not provided (not suitable for production).\n * \n * @see {@link SessionHandler}\n */\n sessionHandler?: SessionHandler;\n \n /** \n * Enable debug logging.\n * When enabled, outputs structured logs for initialization, auth flow, and errors.\n * Format: [Lixa] [timestamp] [level] [context] message\n */\n debug?: boolean;\n}\n\n/**\n * Helper type to create a configuration with only registered providers.\n * Use this with Lixa.createConfig() for type safety.\n * \n * @deprecated This type is maintained for backward compatibility.\n * The new inline provider configuration pattern makes this unnecessary.\n *\n * @public\n */\nexport type SafeLixaConfig<TProviders extends Record<string, ProviderConfig>> = LixaConfig<TProviders> & {\n providers: TProviders;\n};\n","import NodeCache from 'node-cache';\nimport { randomBytes } from 'crypto';\nimport { StateHandler, StateStorage, StateData } from \"./types\";\n\nclass LocalStateHandler implements StateHandler {\n private cache: NodeCache;\n public stateStorage: StateStorage;\n\n constructor(defaultTtlSeconds: number = 600) {\n this.cache = new NodeCache({ stdTTL: defaultTtlSeconds });\n \n // Provide storage implementation\n this.stateStorage = {\n saveState: async (state: string, data: StateData, expiresInSeconds: number): Promise<void> => {\n this.cache.set(state, data, expiresInSeconds);\n },\n\n getState: async (state: string): Promise<StateData | null> => {\n return this.cache.get<StateData>(state) || null;\n },\n\n deleteState: async (state: string): Promise<void> => {\n this.cache.del(state);\n }\n };\n }\n\n // Default GenerateState implementation\n async generateState(provider: string): Promise<{ state: string; data: StateData }> {\n const state = randomBytes(16).toString(\"hex\"); // 32 characters\n const codeVerifier = randomBytes(32).toString(\"hex\"); // 64 characters\n \n return {\n state,\n data: {\n provider,\n codeVerifier,\n createdAt: Date.now()\n }\n };\n }\n}\n\nexport { LocalStateHandler };\n","import NodeCache from 'node-cache';\nimport { SessionHandler, SessionStorage } from \"./types\";\nimport type { Session, OAuthTokenResponse, ProviderMetadata } from \"../models/session\";\n\nclass LocalSessionHandler implements SessionHandler {\n private cache: NodeCache;\n private emailToSessionMap: Map<string, string> = new Map();\n public sessionStorage: SessionStorage;\n\n constructor(defaultTtlSeconds: number = 600) {\n this.cache = new NodeCache({ stdTTL: defaultTtlSeconds });\n \n // Provide storage implementation\n this.sessionStorage = {\n saveSession: async <T extends Session>(sessionId: string, session: T, expiresInSeconds: number): Promise<void> => {\n this.cache.set(sessionId, session, expiresInSeconds);\n if (session.email) {\n this.emailToSessionMap.set(session.email.toLowerCase(), sessionId);\n }\n },\n\n getSession: async <T extends Session>(sessionId: string): Promise<T | null> => {\n return this.cache.get<T>(sessionId) || null;\n },\n\n deleteSession: async (sessionId: string): Promise<void> => {\n const session = this.cache.get<Session>(sessionId);\n if (session?.email) {\n this.emailToSessionMap.delete(session.email.toLowerCase());\n }\n this.cache.del(sessionId);\n },\n\n getSessionByEmail: async <T extends Session>(email: string): Promise<{ sessionId: string; session: T } | null> => {\n const normalizedEmail = email.toLowerCase();\n const sessionId = this.emailToSessionMap.get(normalizedEmail);\n if (!sessionId) return null;\n const session = this.cache.get<T>(sessionId);\n if (!session) {\n this.emailToSessionMap.delete(normalizedEmail);\n return null;\n }\n return { sessionId, session };\n }\n };\n }\n\n // Default GenerateSession implementation\n async GenerateSession<T extends Session>(\n tokenData: OAuthTokenResponse,\n providerMetadata: ProviderMetadata\n ): Promise<T> {\n // Default implementation: just use access token as session token\n if (!tokenData.access_token || typeof tokenData.access_token !== 'string') {\n throw new Error('No valid access token found in OAuth response');\n }\n\n const session: Session = {\n token: tokenData.access_token,\n raw: tokenData,\n };\n\n return session as T;\n }\n}\n\nexport { LocalSessionHandler };\n","import type { OAuthTokenResponse, ProviderMetadata } from \"../models/session\";\n\n/**\n * User information extracted from OAuth provider\n * \n * @public\n */\nexport interface UserInfo {\n email: string;\n id?: string | undefined;\n sub?: string | undefined;\n given_name?: string | undefined;\n family_name?: string | undefined;\n name?: string | undefined;\n picture?: string | undefined;\n email_verified?: boolean | undefined;\n iss?: string | undefined;\n}\n\n/**\n * Decode JWT ID token to extract user information\n * \n * @public\n */\nexport function decodeIdToken(idToken: string): UserInfo {\n const parts = idToken.split('.');\n if (parts.length !== 3) {\n throw new Error('Invalid ID token format: expected 3 parts separated by dots');\n }\n \n const base64Payload = parts[1];\n if (!base64Payload) {\n throw new Error('Invalid ID token: missing payload section');\n }\n const payload = Buffer.from(base64Payload, 'base64').toString();\n \n try {\n return JSON.parse(payload);\n } catch (error) {\n throw new Error('Invalid ID token: failed to parse payload JSON');\n }\n}\n\n/**\n * Determine OAuth provider from ID token issuer\n * \n * @public\n */\nexport function determineProviderFromIssuer(userInfo: UserInfo): string | null {\n if (!userInfo.iss) {\n return null;\n }\n \n const issuer = userInfo.iss.toLowerCase();\n \n if (issuer.includes('accounts.google.com')) {\n return 'google';\n }\n \n if (issuer.includes('github')) {\n return 'github';\n }\n \n // Unknown issuer\n return null;\n}\n\n/**\n * Fetch user info from OAuth provider's userinfo endpoint\n * \n * @param accessToken - OAuth access token\n * @param userInfoEndpoint - The provider's userinfo endpoint URL\n * @param providerName - Provider name for error messages (optional)\n * @returns User information from the provider\n * \n * @throws Error if the request fails or response is invalid\n * \n * @public\n */\nexport async function fetchUserInfo(\n accessToken: string, \n userInfoEndpoint: string\n): Promise<UserInfo> {\n const response = await fetch(userInfoEndpoint, {\n headers: {\n Authorization: `Bearer ${accessToken}`,\n Accept: 'application/json',\n },\n });\n \n if (!response.ok) {\n throw new Error(`Failed to fetch user info: ${response.status} ${response.statusText}`);\n }\n \n const data = await response.json();\n if (!data || typeof data !== 'object' || !('email' in data) || typeof data.email !== 'string') {\n throw new Error(`Invalid user info response: missing or invalid email`);\n }\n \n return {\n email: data.email,\n id: 'id' in data ? String(data.id) : undefined,\n sub: 'sub' in data ? String(data.sub) : undefined,\n given_name: 'given_name' in data ? String(data.given_name) : undefined,\n family_name: 'family_name' in data ? String(data.family_name) : undefined,\n name: 'name' in data ? String(data.name) : undefined,\n picture: 'picture' in data ? String(data.picture) : undefined,\n email_verified: 'email_verified' in data ? Boolean(data.email_verified) : undefined,\n iss: 'iss' in data ? String(data.iss) : undefined,\n };\n}\n\n/**\n * Extract user info from OAuth token data\n * \n * @param tokenData - OAuth token response from provider\n * @param providerMetadata - Provider metadata containing endpoints configuration\n * @returns User info extracted from token or fetched from provider\n * \n * @remarks\n * This function attempts to extract user information in the following order:\n * 1. Decode ID token if present (preferred method for OIDC providers)\n * 2. Fetch from userinfo endpoint using access token (uses providerMetadata.endpoints.userInfo)\n * \n * The function automatically determines the best method based on available token data.\n * For OIDC providers (like Google), it decodes the JWT ID token.\n * For OAuth-only providers (like GitHub), it fetches from the userinfo endpoint.\n * \n * @throws Error if no ID token or access token is available\n * @throws Error if userinfo endpoint is required but not provided in providerMetadata\n * \n * @example\n * With ID token (OIDC provider like Google):\n * ```typescript\n * const { userInfo } = await extractUserInfo(tokenData, providerMetadata);\n * console.log(`User ${userInfo.email} authenticated`);\n * ```\n * \n * @example\n * Without ID token (OAuth provider like GitHub):\n * ```typescript\n * const { userInfo } = await extractUserInfo(tokenData, providerMetadata);\n * // Automatically fetches from providerMetadata.endpoints.userInfo\n * console.log(`User ${userInfo.email} authenticated`);\n * ```\n * \n * @public\n */\nexport async function extractUserInfo(\n tokenData: OAuthTokenResponse,\n providerMetadata: ProviderMetadata\n): Promise<{ userInfo: UserInfo }> {\n let userInfo: UserInfo;\n const userInfoEndpoint = providerMetadata.endpoints.userInfo;\n \n if (tokenData.id_token) {\n // Decode ID token to get user info\n userInfo = decodeIdToken(tokenData.id_token);\n } else if (tokenData.access_token) {\n // Fetch user info from provider's API\n userInfo = await fetchUserInfo(tokenData.access_token, userInfoEndpoint);\n } else {\n throw new Error('No ID token or access token available to fetch user info');\n }\n \n return { userInfo };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,IAAAA,iBAA4B;;;AC8IrB,IAAK,yBAAL,kBAAKC,4BAAL;AAEL,EAAAA,wBAAA,iCAA8B;AAG9B,EAAAA,wBAAA,cAAW;AALD,SAAAA;AAAA,GAAA;;;AC9IZ,wBAAsB;AACtB,oBAA4B;AAG5B,IAAM,oBAAN,MAAgD;AAAA,EACtC;AAAA,EACD;AAAA,EAEP,YAAY,oBAA4B,KAAK;AAC3C,SAAK,QAAQ,IAAI,kBAAAC,QAAU,EAAE,QAAQ,kBAAkB,CAAC;AAGxD,SAAK,eAAe;AAAA,MAClB,WAAW,OAAO,OAAe,MAAiB,qBAA4C;AAC5F,aAAK,MAAM,IAAI,OAAO,MAAM,gBAAgB;AAAA,MAC9C;AAAA,MAEA,UAAU,OAAO,UAA6C;AAC5D,eAAO,KAAK,MAAM,IAAe,KAAK,KAAK;AAAA,MAC7C;AAAA,MAEA,aAAa,OAAO,UAAiC;AACnD,aAAK,MAAM,IAAI,KAAK;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,cAAc,UAA+D;AACjF,UAAM,YAAQ,2BAAY,EAAE,EAAE,SAAS,KAAK;AAC5C,UAAM,mBAAe,2BAAY,EAAE,EAAE,SAAS,KAAK;AAEnD,WAAO;AAAA,MACL;AAAA,MACA,MAAM;AAAA,QACJ;AAAA,QACA;AAAA,QACA,WAAW,KAAK,IAAI;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AACF;;;AFpCA,IAAAC,iBAAmB;;;AGLnB,IAAAC,qBAAsB;AAItB,IAAM,sBAAN,MAAoD;AAAA,EAC1C;AAAA,EACA,oBAAyC,oBAAI,IAAI;AAAA,EAClD;AAAA,EAEP,YAAY,oBAA4B,KAAK;AAC3C,SAAK,QAAQ,IAAI,mBAAAC,QAAU,EAAE,QAAQ,kBAAkB,CAAC;AAGxD,SAAK,iBAAiB;AAAA,MACpB,aAAa,OAA0B,WAAmB,SAAY,qBAA4C;AAChH,aAAK,MAAM,IAAI,WAAW,SAAS,gBAAgB;AACnD,YAAI,QAAQ,OAAO;AACjB,eAAK,kBAAkB,IAAI,QAAQ,MAAM,YAAY,GAAG,SAAS;AAAA,QACnE;AAAA,MACF;AAAA,MAEA,YAAY,OAA0B,cAAyC;AAC7E,eAAO,KAAK,MAAM,IAAO,SAAS,KAAK;AAAA,MACzC;AAAA,MAEA,eAAe,OAAO,cAAqC;AACzD,cAAM,UAAU,KAAK,MAAM,IAAa,SAAS;AACjD,YAAI,SAAS,OAAO;AAClB,eAAK,kBAAkB,OAAO,QAAQ,MAAM,YAAY,CAAC;AAAA,QAC3D;AACA,aAAK,MAAM,IAAI,SAAS;AAAA,MAC1B;AAAA,MAEA,mBAAmB,OAA0B,UAAqE;AAChH,cAAM,kBAAkB,MAAM,YAAY;AAC1C,cAAM,YAAY,KAAK,kBAAkB,IAAI,eAAe;AAC5D,YAAI,CAAC,UAAW,QAAO;AACvB,cAAM,UAAU,KAAK,MAAM,IAAO,SAAS;AAC3C,YAAI,CAAC,SAAS;AACZ,eAAK,kBAAkB,OAAO,eAAe;AAC7C,iBAAO;AAAA,QACT;AACA,eAAO,EAAE,WAAW,QAAQ;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,gBACJ,WACA,kBACY;AAEZ,QAAI,CAAC,UAAU,gBAAgB,OAAO,UAAU,iBAAiB,UAAU;AACzE,YAAM,IAAI,MAAM,+CAA+C;AAAA,IACjE;AAEA,UAAM,UAAmB;AAAA,MACvB,OAAO,UAAU;AAAA,MACjB,KAAK;AAAA,IACP;AAEA,WAAO;AAAA,EACT;AACF;;;ACxCO,SAAS,cAAc,SAA2B;AACvD,QAAM,QAAQ,QAAQ,MAAM,GAAG;AAC/B,MAAI,MAAM,WAAW,GAAG;AACtB,UAAM,IAAI,MAAM,6DAA6D;AAAA,EAC/E;AAEA,QAAM,gBAAgB,MAAM,CAAC;AAC7B,MAAI,CAAC,eAAe;AAClB,UAAM,IAAI,MAAM,2CAA2C;AAAA,EAC7D;AACA,QAAM,UAAU,OAAO,KAAK,eAAe,QAAQ,EAAE,SAAS;AAE9D,MAAI;AACF,WAAO,KAAK,MAAM,OAAO;AAAA,EAC3B,SAAS,OAAO;AACd,UAAM,IAAI,MAAM,gDAAgD;AAAA,EAClE;AACF;AAOO,SAAS,4BAA4B,UAAmC;AAC7E,MAAI,CAAC,SAAS,KAAK;AACjB,WAAO;AAAA,EACT;AAEA,QAAM,SAAS,SAAS,IAAI,YAAY;AAExC,MAAI,OAAO,SAAS,qBAAqB,GAAG;AAC1C,WAAO;AAAA,EACT;AAEA,MAAI,OAAO,SAAS,QAAQ,GAAG;AAC7B,WAAO;AAAA,EACT;AAGA,SAAO;AACT;AAcA,eAAsB,cACpB,aACA,kBACmB;AACnB,QAAM,WAAW,MAAM,MAAM,kBAAkB;AAAA,IAC7C,SAAS;AAAA,MACP,eAAe,UAAU,WAAW;AAAA,MACpC,QAAQ;AAAA,IACV;AAAA,EACF,CAAC;AAED,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,MAAM,8BAA8B,SAAS,MAAM,IAAI,SAAS,UAAU,EAAE;AAAA,EACxF;AAEA,QAAM,OAAO,MAAM,SAAS,KAAK;AACjC,MAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,EAAE,WAAW,SAAS,OAAO,KAAK,UAAU,UAAU;AAC7F,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AAEA,SAAO;AAAA,IACL,OAAO,KAAK;AAAA,IACZ,IAAI,QAAQ,OAAO,OAAO,KAAK,EAAE,IAAI;AAAA,IACrC,KAAK,SAAS,OAAO,OAAO,KAAK,GAAG,IAAI;AAAA,IACxC,YAAY,gBAAgB,OAAO,OAAO,KAAK,UAAU,IAAI;AAAA,IAC7D,aAAa,iBAAiB,OAAO,OAAO,KAAK,WAAW,IAAI;AAAA,IAChE,MAAM,UAAU,OAAO,OAAO,KAAK,IAAI,IAAI;AAAA,IAC3C,SAAS,aAAa,OAAO,OAAO,KAAK,OAAO,IAAI;AAAA,IACpD,gBAAgB,oBAAoB,OAAO,QAAQ,KAAK,cAAc,IAAI;AAAA,IAC1E,KAAK,SAAS,OAAO,OAAO,KAAK,GAAG,IAAI;AAAA,EAC1C;AACF;AAsCA,eAAsB,gBACpB,WACA,kBACiC;AACjC,MAAI;AACJ,QAAM,mBAAmB,iBAAiB,UAAU;AAEpD,MAAI,UAAU,UAAU;AAEtB,eAAW,cAAc,UAAU,QAAQ;AAAA,EAC7C,WAAW,UAAU,cAAc;AAEjC,eAAW,MAAM,cAAc,UAAU,cAAc,gBAAgB;AAAA,EACzE,OAAO;AACL,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AAEA,SAAO,EAAE,SAAS;AACpB;;;AJnGA,IAAM,OAAN,MAAM,MAA8E;AAAA,EAClF,OAAe,oBAA4C,oBAAI,IAAI;AAAA,EACnE,OAAe,uBAA+C,oBAAI,IAAI;AAAA;AAAA,EACtE,OAAe,sBAAsB,IAAI,kBAAkB;AAAA,EAC3D,OAAe,wBAAwB,IAAI,oBAAoB;AAAA,EACvD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeR,YAAY,QAAiB;AAC3B,SAAK,SAAS;AACd,SAAK,eAAe,OAAO,gBAAgB,MAAK;AAChD,SAAK,iBAAiB,OAAO,kBAAkB,MAAK;AACpD,SAAK,QAAQ,OAAO,SAAS;AAE7B,SAAK,IAAI,QAAQ,QAAQ,8BAA8B;AAAA,MACrD,WAAW,OAAO,KAAK,OAAO,SAAS;AAAA,MACvC,OAAO,KAAK;AAAA,IACd,CAAC;AAGD,eAAW,CAAC,cAAc,cAAc,KAAK,OAAO,QAAQ,OAAO,SAAS,GAAG;AAC7E,YAAM,OAAO,aAAa,YAAY;AACtC,YAAM,cAA8B;AAGpC,WAAK,uBAAuB,cAAc,WAAW;AAGrD,UAAI,YAAY,UAAU;AACxB,aAAK,+BAA+B,cAAc,YAAY,QAAQ;AACtE,aAAK,IAAI,QAAQ,QAAQ,+BAA+B,YAAY,EAAE;AAAA,MACxE,OAAO;AAEL,YAAI,CAAC,MAAK,kBAAkB,IAAI,IAAI,KAAK,CAAC,MAAK,qBAAqB,IAAI,IAAI,GAAG;AAC7E,eAAK,IAAI,SAAS,QAAQ,aAAa,YAAY,iBAAiB;AACpE,gBAAM,IAAI;AAAA,YACR,aAAa,YAAY;AAAA,UAI3B;AAAA,QACF;AACA,aAAK,IAAI,QAAQ,QAAQ,8BAA8B,YAAY,EAAE;AAAA,MACvE;AAAA,IACF;AAEA,SAAK,IAAI,QAAQ,QAAQ,wCAAwC;AAAA,EACnE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,uBAAuB,MAAc,QAA8B;AACzE,UAAM,iBAA2C,CAAC,YAAY,gBAAgB,eAAe,QAAQ;AACrG,UAAM,gBAAgB,eAAe,OAAO,WAAS;AACnD,YAAM,QAAQ,OAAO,KAAK;AAC1B,aAAO,UAAU,UAAa,UAAU,QAAS,OAAO,UAAU,YAAY,MAAM,KAAK,MAAM;AAAA,IACjG,CAAC;AAED,QAAI,cAAc,SAAS,GAAG;AAC5B,YAAM,IAAI;AAAA,QACR,aAAa,IAAI,+CAA+C,cAAc,KAAK,IAAI,CAAC;AAAA,MAC1F;AAAA,IACF;AAGA,QAAI,CAAC,MAAM,QAAQ,OAAO,MAAM,GAAG;AACjC,YAAM,IAAI;AAAA,QACR,aAAa,IAAI;AAAA,MACnB;AAAA,IACF;AAEA,QAAI,OAAO,OAAO,WAAW,GAAG;AAC9B,YAAM,IAAI;AAAA,QACR,aAAa,IAAI;AAAA,MACnB;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,+BAA+B,MAAc,UAA2B;AAC9E,UAAM,gBAAqC,CAAC,yBAAyB,iBAAiB,kBAAkB;AACxG,UAAM,eAAe,cAAc,OAAO,UAAQ;AAChD,YAAM,QAAQ,SAAS,IAAI;AAC3B,aAAO,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,KAAK,MAAM;AAAA,IACjE,CAAC;AAED,QAAI,aAAa,SAAS,GAAG;AAC3B,YAAM,IAAI;AAAA,QACR,aAAa,IAAI,oDAAoD,aAAa,KAAK,IAAI,CAAC;AAAA,MAE9F;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcQ,IAAI,OAAkC,SAA6E,SAAiB,MAAmE;AAC7M,QAAI,CAAC,KAAK,MAAO;AAEjB,UAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AACzC,UAAM,SAAS,WAAW,SAAS,MAAM,KAAK,MAAM,OAAO;AAE3D,QAAI,SAAS,QAAW;AACtB,cAAQ,IAAI,GAAG,MAAM,IAAI,OAAO,IAAI,IAAI;AAAA,IAC1C,OAAO;AACL,cAAQ,IAAI,GAAG,MAAM,IAAI,OAAO,EAAE;AAAA,IACpC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBO,qBAAuC,UAA6D;AACzG,UAAM,eAAe,SAAS,YAAY;AAC1C,WAAO,KAAK,OAAO,UAAU,eAAe,YAAY;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWQ,YAAY,MAAc,QAAmC;AAEnE,QAAI,OAAO,UAAU;AACnB,aAAO,OAAO;AAAA,IAChB;AAGA,UAAM,YAAY,KAAK,YAAY;AACnC,UAAM,kBAAkB,MAAK,kBAAkB,IAAI,SAAS;AAC5D,QAAI,iBAAiB;AACnB,aAAO;AAAA,IACT;AAGA,UAAM,iBAAiB,MAAK,qBAAqB,IAAI,SAAS;AAC9D,QAAI,gBAAgB;AAClB,aAAO;AAAA,IACT;AAEA,UAAM,IAAI;AAAA,MACR,aAAa,IAAI;AAAA,IAGnB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiCA,OAAc,iBAAsD,aAAsB;AACxF,WAAO,QAAQ,WAAW,EAAE,QAAQ,CAAC,CAAC,KAAK,YAAY,MAAM;AAC3D,YAAK,qBAAqB,IAAI,IAAI,YAAY,GAAG,YAAY;AAAA,IAC/D,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAc,yBAAmC;AAC/C,WAAO,MAAM,KAAK,MAAK,qBAAqB,KAAK,CAAC;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAyBA,OAAc,aACZ,QACe;AACf,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,OAAc,sBAA8B;AAC1C,eAAO,4BAAY,EAAE,EAAE,SAAS,KAAK;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoCA,OAAe,uBAA+B;AAC5C,eAAO,4BAAY,EAAE,EAAE,SAAS,KAAK;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA6CA,OAAe,mBAAmB,cAA8B;AAC9D,UAAM,OAAO,eAAAC,QACV,WAAW,QAAQ,EACnB,OAAO,YAAY,EACnB,OAAO,QAAQ;AAGlB,WAAO,KAAK,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAAA,EACvE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,MAAa,WAAW,UAAmD,OAAiC;AAC1G,UAAM,eAAe,OAAO,QAAQ,EAAE,YAAY;AAElD,SAAK,IAAI,QAAQ,QAAQ,8CAA8C,YAAY,EAAE;AAErF,UAAM,iBAAiB,KAAK,mBAAmB,YAAY;AAE3D,QAAI,CAAC,gBAAgB;AACnB,WAAK,IAAI,SAAS,QAAQ,aAAa,OAAO,QAAQ,CAAC,qBAAqB;AAC5E,YAAM,IAAI,MAAM,aAAa,OAAO,QAAQ,CAAC,2CAA2C;AAAA,IAC1F;AAEA,UAAM,eAAe,KAAK,YAAY,cAAc,cAAc;AAGlE,QAAI;AACJ,QAAI;AAEJ,QAAI,KAAK,aAAa,eAAe;AACnC,WAAK,IAAI,QAAQ,SAAS,8BAA8B;AACxD,YAAM,YAAY,MAAM,KAAK,aAAa,cAAc,YAAY;AACpE,mBAAa,SAAS,UAAU;AAChC,qBAAe,UAAU,KAAK;AAG9B,YAAM,UAAU,KAAK,aAAa,gBAAgB,MAAK,oBAAoB;AAC3E,YAAM,QAAQ,UAAU,YAAY,UAAU,MAAM,GAAG;AAAA,IACzD,OAAO;AACL,WAAK,IAAI,QAAQ,SAAS,gCAAgC;AAC1D,mBAAa,aAAS,4BAAY,EAAE,EAAE,SAAS,KAAK;AACpD,yBAAe,4BAAY,EAAE,EAAE,SAAS,KAAK;AAG7C,YAAM,UAAU,KAAK,aAAa,gBAAgB,MAAK,oBAAoB;AAC3E,YAAM,QAAQ;AAAA,QACZ;AAAA,QACA;AAAA,UACE,WAAW,KAAK,IAAI;AAAA,UACpB,UAAU;AAAA,UACV;AAAA,QACF;AAAA,QACA;AAAA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,gBAAgB,MAAK,mBAAmB,YAAY;AAE1D,SAAK,IAAI,QAAQ,SAAS,6BAA6B,YAAY,IAAI,EAAE,OAAO,WAAW,CAAC;AAE5F,UAAM,cAAc,KAAK,mBAAmB,cAAc,eAAe,QAAQ,YAAY;AAE7F,UAAM,SAAS,IAAI,gBAAgB;AAAA,MACjC,WAAW,eAAe;AAAA,MAC1B,cAAc,eAAe;AAAA,MAC7B,OAAO,YAAY,KAAK,GAAG;AAAA,MAC3B,OAAO;AAAA,MACP,eAAe;AAAA,MACf,gBAAgB;AAAA,MAChB,uBAAuB;AAAA,MACvB,GAAG,eAAe;AAAA,IACpB,CAAC;AAED,UAAM,UAAU,GAAG,aAAa,qBAAqB,IAAI,OAAO,SAAS,CAAC;AAC1E,SAAK,IAAI,QAAQ,QAAQ,4CAA4C;AAAA,MACnE,UAAU;AAAA,MACV,UAAU,aAAa;AAAA,IACzB,CAAC;AAED,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKQ,mBACN,cACA,kBACA,cACU;AACV,UAAM,oBAA8C;AAAA,MAClD,QAAQ,CAAC,UAAU,SAAS,SAAS;AAAA,MACrC,QAAQ,CAAC,aAAa,YAAY;AAAA,MAClC,WAAW,CAAC,UAAU,SAAS,SAAS;AAAA,IAC1C;AAEA,UAAM,sBAAsB;AAAA,MAC1B;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,UAAM,qBAAqB,oBAAI,IAAY;AAAA,MACzC,GAAG;AAAA,MACH,GAAI,aAAa,cAAc,CAAC;AAAA,MAChC,GAAI,kBAAkB,YAAY,KAAK,CAAC;AAAA,IAC1C,CAAC;AAED,UAAM,oBAAoB,oBAAoB,CAAC,GAAG,OAAO,CAAC,UAAU,mBAAmB,IAAI,KAAK,CAAC;AACjG,UAAM,kBAAkB,oBAAoB,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,mBAAmB,IAAI,KAAK,CAAC;AAEhG,QAAI,eAAe,SAAS,GAAG;AAC7B,WAAK;AAAA,QACH;AAAA,QACA;AAAA,QACA,oGAAoG,eAAe;AAAA,UACjH;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AAEA,QAAI,iBAAiB,SAAS,GAAG;AAC/B,aAAO;AAAA,IACT;AAEA,WAAO,aAAa,cAAc,kBAAkB,YAAY,KAAK,CAAC,UAAU,SAAS,SAAS;AAAA,EACpG;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,MAAa,eAAe;AAAA,IAC1B;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAIoB;AAClB,UAAM,eAAe,OAAO,QAAQ,EAAE,YAAY;AAClD,SAAK,IAAI,QAAQ,QAAQ,yCAAyC,YAAY,EAAE;AAEhF,QAAI,CAAC,QAAQ,KAAK,KAAK,MAAM,IAAI;AAC/B,WAAK,IAAI,SAAS,QAAQ,mDAAmD;AAC7E,YAAM,IAAI,MAAM,qCAAqC;AAAA,IACvD;AAEA,QAAI,CAAC,SAAS,MAAM,KAAK,MAAM,IAAI;AACjC,WAAK,IAAI,SAAS,QAAQ,sCAAsC;AAChE,YAAM,IAAI,MAAM,sCAAsC;AAAA,IACxD;AAEA,SAAK,IAAI,QAAQ,SAAS,8BAA8B,EAAE,MAAM,CAAC;AAGjE,UAAM,eAAe,KAAK,aAAa,gBAAgB,MAAK,oBAAoB;AAChF,UAAM,cAAc,MAAM,aAAa,SAAS,KAAK;AACrD,QAAI,CAAC,aAAa;AAChB,WAAK,IAAI,SAAS,SAAS,uDAAuD,EAAE,MAAM,CAAC;AAC3F,YAAM,IAAI,MAAM,0BAA0B;AAAA,IAC5C;AAEA,SAAK,IAAI,QAAQ,SAAS,mDAAmD;AAE7E,UAAM,aAAa,YAAY,KAAK;AAGpC,UAAM,eAAe,YAAY;AAEjC,UAAM,iBAAiB,KAAK,mBAAmB,YAAY;AAE3D,QAAI,CAAC,gBAAgB;AACnB,WAAK,IAAI,SAAS,QAAQ,aAAa,OAAO,QAAQ,CAAC,qBAAqB;AAC5E,YAAM,IAAI,MAAM,aAAa,OAAO,QAAQ,CAAC,2CAA2C;AAAA,IAC1F;AAEA,UAAM,eAAe,KAAK,YAAY,cAAc,cAAc;AAElE,SAAK,IAAI,QAAQ,SAAS,4CAA4C,EAAE,UAAU,aAAa,CAAC;AAGhG,UAAM,SAAS,MAAM,KAAK;AAAA,MACxB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,SAAK,IAAI,QAAQ,SAAS,2BAA2B;AACrD,SAAK,IAAI,QAAQ,WAAW,yBAAyB;AAGrD,UAAM,mBAAqC;AAAA,MACzC,MAAM;AAAA,MACN,WAAW;AAAA,QACT,eAAe,aAAa;AAAA,QAC5B,OAAO,aAAa;AAAA,QACpB,UAAU,aAAa;AAAA,MACzB;AAAA,IACF;AAGA,QAAI;AACJ,QAAI;AACF,YAAM,EAAE,SAAS,IAAI,MAAM,gBAAgB,QAAQ,gBAAgB;AACnE,0BAAoB;AAAA,IACtB,QAAQ;AAAA,IAER;AAGA,UAAM,kBAAkB,KAAK,eAAe,mBAAmB,MAAK,sBAAsB,gBAAiB,KAAK,MAAK,qBAAqB;AAE1I,QAAI,KAAK,eAAe,iBAAiB;AACvC,WAAK,IAAI,QAAQ,WAAW,gCAAgC;AAAA,IAC9D,OAAO;AACL,WAAK,IAAI,QAAQ,WAAW,kCAAkC;AAAA,IAChE;AAEA,UAAM,UAAU,MAAM,gBAAgB,QAAQ,gBAAgB;AAC9D,YAAQ,WAAW,QAAQ,YAAY;AACvC,QAAI,mBAAmB,SAAS,CAAC,QAAQ,OAAO;AAC9C,cAAQ,QAAQ,kBAAkB;AAAA,IACpC;AAEA,UAAM,iBAAiB,KAAK,eAAe,kBAAkB,MAAK,sBAAsB;AAGxF,UAAM,gBAAgB,KAAK,OAAO;AAClC,UAAM,OAAO,OAAO,eAAe,QAAQ,EAAE;AAC7C,UAAM,gBACJ,4EACA,SAAS,iCACT,SAAS;AACX,UAAM,QAAQ,mBAAmB;AACjC,UAAM,aAAa,mBAAmB,mBAAmB;AACzD,UAAM,kBAAkB,eAAe,wBAAwB;AAC/D,UAAM,UAAU,iBAAiB,UAAU,CAAC,mBAAmB;AAE/D,QAAI,WAAW,eAAe,mBAAmB;AAC/C,YAAM,iBAAiB,MAAM,eAAe,kBAAkB,KAAK;AACnE,UAAI,gBAAgB;AAClB,aAAK,IAAI,QAAQ,kBAAkB,qBAAqB,YAAY,oCAAoC,KAAK,GAAG;AAChH,cAAM,EAAE,WAAW,mBAAmB,SAAS,gBAAgB,IAAI;AAEnE,wBAAgB,WAAW,gBAAgB,YAAY,CAAC;AACxD,wBAAgB,SAAS,YAAY,IAAI;AAAA,UACvC,UAAU;AAAA,UACV,gBAAgB,mBAAmB,OAAO,mBAAmB;AAAA,UAC7D;AAAA,UACA,aAAa,OAAO;AAAA,UACpB,KAAK;AAAA,UACL,UAAU,KAAK,IAAI;AAAA,QACrB;AACA,wBAAgB,WAAW;AAC3B,wBAAgB,QAAQ,OAAO;AAC/B,wBAAgB,MAAM;AAEtB,cAAM,eAAe,YAAY,mBAAmB,iBAAiB,KAAK;AAC1E,eAAO;AAAA,MACT;AAAA,IACF;AAGA,YAAQ,WAAW,QAAQ,YAAY,CAAC;AACxC,YAAQ,SAAS,YAAY,IAAI;AAAA,MAC/B,UAAU;AAAA,MACV,gBAAgB,mBAAmB,OAAO,mBAAmB;AAAA,MAC7D,OAAO,mBAAmB;AAAA,MAC1B,aAAa,OAAO;AAAA,MACpB,KAAK;AAAA,MACL,UAAU,KAAK,IAAI;AAAA,IACrB;AAGA,UAAM,gBAAY,4BAAY,EAAE,EAAE,SAAS,KAAK;AAChD,YAAQ,KAAK;AAEb,SAAK,IAAI,QAAQ,WAAW,mBAAmB,EAAE,UAAU,CAAC;AAC5D,UAAM,eAAe,YAAY,WAAW,SAAS,KAAK;AAE1D,SAAK,IAAI,QAAQ,WAAW,gCAAgC,EAAE,UAAU,CAAC;AAEzE,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAa,YAAY,QAKL;AAClB,UAAM,EAAE,WAAW,UAAU,MAAM,MAAM,IAAI;AAC7C,UAAM,iBAAiB,KAAK,eAAe,kBAAkB,MAAK,sBAAsB;AACxF,UAAM,kBAAkB,MAAM,eAAe,WAAW,SAAS;AAEjE,QAAI,CAAC,iBAAiB;AACpB,YAAM,IAAI,MAAM,oEAAoE;AAAA,IACtF;AAEA,UAAM,eAAe,OAAO,QAAQ,EAAE,YAAY;AAClD,UAAM,iBAAiB,KAAK,mBAAmB,YAAY;AAC3D,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,MAAM,aAAa,OAAO,QAAQ,CAAC,qBAAqB;AAAA,IACpE;AACA,UAAM,eAAe,KAAK,YAAY,cAAc,cAAc;AAGlE,QAAI,mBAAe,4BAAY,EAAE,EAAE,SAAS,KAAK;AACjD,QAAI,OAAO;AACT,YAAM,eAAe,KAAK,aAAa,gBAAgB,MAAK,oBAAoB;AAChF,YAAM,cAAc,MAAM,aAAa,SAAS,KAAK;AACrD,UAAI,aAAa;AACf,uBAAe,YAAY;AAC3B,cAAM,aAAa,YAAY,KAAK;AAAA,MACtC;AAAA,IACF;AAEA,UAAM,SAAS,MAAM,KAAK,qBAAqB,cAAc,gBAAgB,cAAc,YAAY;AAEvG,UAAM,mBAAqC;AAAA,MACzC,MAAM;AAAA,MACN,WAAW;AAAA,QACT,eAAe,aAAa;AAAA,QAC5B,OAAO,aAAa;AAAA,QACpB,UAAU,aAAa;AAAA,MACzB;AAAA,IACF;AAEA,QAAI;AACJ,QAAI;AACF,YAAM,EAAE,SAAS,IAAI,MAAM,gBAAgB,QAAQ,gBAAgB;AACnE,0BAAoB;AAAA,IACtB,QAAQ;AAAA,IAER;AAEA,oBAAgB,WAAW,gBAAgB,YAAY,CAAC;AACxD,oBAAgB,SAAS,YAAY,IAAI;AAAA,MACvC,UAAU;AAAA,MACV,gBAAgB,mBAAmB,OAAO,mBAAmB;AAAA,MAC7D,OAAO,mBAAmB;AAAA,MAC1B,aAAa,OAAO;AAAA,MACpB,KAAK;AAAA,MACL,UAAU,KAAK,IAAI;AAAA,IACrB;AAEA,QAAI,mBAAmB,SAAS,CAAC,gBAAgB,OAAO;AACtD,sBAAgB,QAAQ,kBAAkB;AAAA,IAC5C;AAEA,UAAM,eAAe,YAAY,WAAW,iBAAiB,KAAK;AAClE,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAa,cAAc,WAAmB,kBAA4C;AACxF,UAAM,iBAAiB,KAAK,eAAe,kBAAkB,MAAK,sBAAsB;AACxF,UAAM,UAAU,MAAM,eAAe,WAAW,SAAS;AAEzD,QAAI,CAAC,WAAW,CAAC,QAAQ,UAAU;AACjC,YAAM,IAAI,MAAM,8CAA8C;AAAA,IAChE;AAEA,UAAM,kBAAkB,OAAO,KAAK,QAAQ,QAAQ;AACpD,QAAI,gBAAgB,UAAU,GAAG;AAC/B,YAAM,IAAI,MAAM,kEAAkE;AAAA,IACpF;AAEA,WAAO,QAAQ,SAAS,iBAAiB,YAAY,CAAC;AACtD,UAAM,eAAe,YAAY,WAAW,SAAS,KAAK;AAC1D,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAa,mBAAmB,QAOZ;AAClB,UAAM,EAAE,WAAW,UAAU,QAAQ,OAAO,QAAQ,YAAY,IAAI;AACpE,UAAM,iBAAiB,KAAK,eAAe,kBAAkB,MAAK,sBAAsB;AACxF,UAAM,gBAAgB,MAAM,eAAe,WAAW,SAAS;AAE/D,QAAI,CAAC,eAAe;AAClB,YAAM,IAAI,MAAM,mFAAmF;AAAA,IACrG;AAEA,UAAM,eAAe,OAAO,QAAQ,EAAE,YAAY;AAClD,UAAM,iBAAiB,KAAK,mBAAmB,YAAY;AAC3D,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,MAAM,aAAa,OAAO,QAAQ,CAAC,qBAAqB;AAAA,IACpE;AAEA,UAAM,eAAe,KAAK,YAAY,cAAc,cAAc;AAClE,UAAM,aAAa,aAAS,4BAAY,EAAE,EAAE,SAAS,KAAK;AAC1D,UAAM,mBAAe,4BAAY,EAAE,EAAE,SAAS,KAAK;AAEnD,UAAM,UAAU,KAAK,aAAa,gBAAgB,MAAK,oBAAoB;AAC3E,UAAM,QAAQ;AAAA,MACZ;AAAA,MACA;AAAA,QACE,WAAW,KAAK,IAAI;AAAA,QACpB,UAAU;AAAA,QACV;AAAA,MACF;AAAA,MACA;AAAA,IACF;AAEA,UAAM,gBAAgB,MAAK,mBAAmB,YAAY;AAE1D,UAAM,eAAe,IAAI,gBAAgB;AAAA,MACvC,WAAW,eAAe;AAAA,MAC1B,cAAc,eAAe;AAAA,MAC7B,OAAO,OAAO,KAAK,GAAG;AAAA,MACtB,OAAO;AAAA,MACP,eAAe;AAAA,MACf,gBAAgB;AAAA,MAChB,uBAAuB;AAAA,MACvB,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,MAC3B,GAAG,eAAe;AAAA,MAClB,GAAG;AAAA,IACL,CAAC;AAED,WAAO,GAAG,aAAa,qBAAqB,IAAI,aAAa,SAAS,CAAC;AAAA,EACzE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAa,uBAAuB,QAMf;AACnB,UAAM,EAAE,WAAW,UAAU,MAAM,OAAO,OAAO,IAAI;AACrD,UAAM,iBAAiB,KAAK,eAAe,kBAAkB,MAAK,sBAAsB;AACxF,UAAM,gBAAgB,MAAM,eAAe,WAAW,SAAS;AAE/D,QAAI,CAAC,eAAe;AAClB,YAAM,IAAI,MAAM,4EAA4E;AAAA,IAC9F;AAEA,UAAM,eAAe,OAAO,QAAQ,EAAE,YAAY;AAClD,UAAM,iBAAiB,KAAK,mBAAmB,YAAY;AAC3D,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,MAAM,aAAa,OAAO,QAAQ,CAAC,qBAAqB;AAAA,IACpE;AACA,UAAM,eAAe,KAAK,YAAY,cAAc,cAAc;AAElE,QAAI,mBAAe,4BAAY,EAAE,EAAE,SAAS,KAAK;AACjD,QAAI,OAAO;AACT,YAAM,eAAe,KAAK,aAAa,gBAAgB,MAAK,oBAAoB;AAChF,YAAM,cAAc,MAAM,aAAa,SAAS,KAAK;AACrD,UAAI,aAAa;AACf,uBAAe,YAAY;AAC3B,cAAM,aAAa,YAAY,KAAK;AAAA,MACtC;AAAA,IACF;AAEA,UAAM,SAAS,MAAM,KAAK,qBAAqB,MAAM,gBAAgB,cAAc,YAAY;AAE/F,kBAAc,YAAY,cAAc,aAAa,CAAC;AACtD,kBAAc,UAAU,YAAY,IAAI;AAAA,MACtC,UAAU;AAAA,MACV,aAAa,OAAO;AAAA,MACpB,cAAc,OAAO;AAAA,MACrB,QAAQ,WAAW,OAAO,QAAQ,OAAO,MAAM,MAAM,GAAG,IAAI,CAAC;AAAA,MAC7D,KAAK;AAAA,MACL,aAAa,KAAK,IAAI;AAAA,IACxB;AAEA,UAAM,eAAe,YAAY,WAAW,eAAe,KAAK;AAChE,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAa,qBAAqB,WAAmB,UAAqD;AACxG,UAAM,iBAAiB,KAAK,eAAe,kBAAkB,MAAK,sBAAsB;AACxF,UAAM,gBAAgB,MAAM,eAAe,WAAW,SAAS;AAC/D,QAAI,CAAC,iBAAiB,CAAC,cAAc,UAAW,QAAO;AACvD,WAAO,cAAc,UAAU,SAAS,YAAY,CAAC,KAAK;AAAA,EAC5D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAa,mBAAmB,WAAmB,UAAoC;AACrF,UAAM,iBAAiB,KAAK,eAAe,kBAAkB,MAAK,sBAAsB;AACxF,UAAM,gBAAgB,MAAM,eAAe,WAAW,SAAS;AAC/D,QAAI,CAAC,iBAAiB,CAAC,cAAc,UAAW,QAAO;AACvD,WAAO,cAAc,UAAU,SAAS,YAAY,CAAC;AACrD,UAAM,eAAe,YAAY,WAAW,eAAe,KAAK;AAChE,WAAO;AAAA,EACT;AAAA,EAEA,MAAa,iBAAiB,WAA4C;AACxE,UAAM,iBAAiB,KAAK,eAAe,kBAAkB,MAAK,sBAAsB;AACxF,WAAO,MAAM,eAAe,WAAoB,SAAS;AAAA,EAC3D;AAAA,EAEA,MAAc,qBACZ,MACA,gBACA,cACA,cAC6B;AAE7B,UAAM,OAA+B;AAAA,MACnC,WAAW,eAAe;AAAA,MAC1B,eAAe,eAAe;AAAA,MAC9B;AAAA,MACA,cAAc,eAAe;AAAA,MAC7B,YAAY;AAAA,IACd;AAEA,QAAI,cAAc;AAChB,WAAK,gBAAgB;AAAA,IACvB;AACA,UAAM,SAAS,IAAI,gBAAgB,IAAI;AAEvC,SAAK,IAAI,QAAQ,SAAS,kCAAkC;AAAA,MAC1D,UAAU,aAAa;AAAA,IACzB,CAAC;AAED,UAAM,WAAW,MAAM,MAAM,aAAa,eAAe;AAAA,MACvD,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,QAAQ;AAAA,MACV;AAAA,MACA,MAAM,OAAO,SAAS;AAAA,IACxB,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,YAAY,MAAM,SAAS,KAAK;AACtC,WAAK,IAAI,SAAS,SAAS,yBAAyB;AAAA,QAClD,QAAQ,SAAS;AAAA,QACjB,YAAY,SAAS;AAAA,QACrB,OAAO;AAAA,MACT,CAAC;AACD,YAAM,IAAI;AAAA,QACR,0BAA0B,SAAS,MAAM,IAAI,SAAS,UAAU,MAAM,SAAS;AAAA,MACjF;AAAA,IACF;AAEA,SAAK,IAAI,QAAQ,SAAS,+CAA+C;AACzE,WAAO,SAAS,KAAK;AAAA,EACvB;AAAA,EAEQ,mBAAmB,cAAkD;AAE3E,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,OAAO,SAAS,GAAG;AAChE,UAAI,IAAI,YAAY,MAAM,aAAa,YAAY,GAAG;AACpD,eAAO;AAAA,MACT;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;","names":["import_crypto","AccountLinkingStrategy","NodeCache","import_crypto","import_node_cache","NodeCache","crypto"]}
1
+ {"version":3,"sources":["../src/index.ts","../src/lixa.ts","../src/types.ts","../src/dao/state-cache.ts","../src/dao/session-cache.ts","../src/utils/user-info.ts","../src/errors.ts","../src/utils/cookies.ts"],"sourcesContent":["/**\n * A flexible, provider-agnostic OAuth 2.0 and OpenID Connect (OIDC) client library for backend applications.\n * \n * @remarks\n * This package simplifies multi-provider authentication flows (e.g., Google, GitHub), supports extensible session management, and enables custom provider registration.\n * \n * Key features:\n * - OAuth 2.0 authorization code flow with PKCE (RFC 6749, RFC 7636)\n * - OpenID Connect support\n * - Built-in providers available in \\@vunexa/lixa-providers\n * - Custom provider support via IProvider interface\n * - Extensible session management via SessionDao.CreateSession\n * - Pluggable state and session storage via StateDao and SessionDao\n * - TypeScript-first with comprehensive type safety\n * \n * @packageDocumentation\n */\n\nexport { Lixa } from \"./lixa\";\nexport {\n type ProviderConfig,\n type LixaConfig,\n type SafeLixaConfig,\n type IProvider,\n type Session,\n type ConnectedResource,\n type ProviderMetadata,\n type OAuthTokenResponse,\n type StateHandler,\n type StateStorage,\n type SessionHandler,\n type SessionStorage,\n type ResourceHandler,\n type ResourceStorage,\n type StateData,\n AccountLinkingStrategy,\n type AccountLinkingMode,\n type AccountLinkingConfig,\n type LogLevel,\n type LogContext,\n type LixaLogger,\n} from \"./types\";\nexport {\n type UserInfo,\n extractUserInfo,\n decodeIdToken,\n fetchUserInfo,\n determineProviderFromIssuer,\n} from \"./utils/user-info\";\nexport {\n LixaError,\n InvalidStateError,\n ProviderNotConfiguredError,\n InvalidProviderConfigError,\n InvalidOAuthCallbackError,\n TokenExchangeError,\n SessionNotFoundError,\n EmailNotVerifiedError,\n AccountUnlinkError,\n RefreshTokenError,\n} from \"./errors\";\nexport {\n type CookieOptions,\n type CookiePayload,\n DEFAULT_SESSION_COOKIE_NAME,\n DEFAULT_STATE_COOKIE_NAME,\n DEFAULT_SESSION_MAX_AGE_SECONDS,\n DEFAULT_STATE_MAX_AGE_SECONDS,\n isProductionEnvironment,\n serializeCookie,\n createSessionCookie,\n clearSessionCookie,\n createStateCookie,\n clearStateCookie,\n} from \"./utils/cookies\";\n\n\n","import { randomBytes } from \"crypto\";\nimport { AccountLinkingStrategy, type LixaConfig, type ProviderConfig } from \"./types\";\nimport { IProvider } from \"./providers\";\nimport { LocalStateHandler } from \"./dao/state-cache\";\nimport { SessionHandler, StateHandler, ResourceHandler, ResourceStorage } from \"./dao/types\";\nimport crypto from \"crypto\";\nimport { LocalSessionHandler } from \"./dao/session-cache\";\nimport { type Session, type ConnectedResource, type OAuthTokenResponse, type ProviderMetadata } from \"./models/session\";\nimport { extractUserInfo, type UserInfo } from \"./utils/user-info\";\nimport {\n LixaError,\n InvalidStateError,\n ProviderNotConfiguredError,\n InvalidProviderConfigError,\n InvalidOAuthCallbackError,\n TokenExchangeError,\n SessionNotFoundError,\n EmailNotVerifiedError,\n AccountUnlinkError,\n RefreshTokenError,\n} from \"./errors\";\n\n/**\n * Type representing the keys of configured providers\n */\ntype ConfiguredProviderKey<T extends LixaConfig<Record<string, ProviderConfig>>> = keyof T['providers'];\n\n/**\n * A flexible, provider-agnostic OAuth 2.0 and OpenID Connect (OIDC) client library.\n *\n * @remarks\n * Lixa simplifies multi-provider authentication flows and supports extensible session management.\n * Providers can be passed inline in the configuration, eliminating the need for pre-registration.\n *\n * @example\n * Using built-in providers from \\@vunexa/lixa-providers:\n * ```typescript\n * import { Lixa } from '@vunexa/lixa';\n * import { GoogleProvider } from '@vunexa/lixa-providers';\n * \n * const lixa = new Lixa({\n * providers: {\n * google: {\n * provider: new GoogleProvider(),\n * clientId: 'your-client-id',\n * clientSecret: 'your-client-secret',\n * redirectUri: 'https://yourapp.com/auth/google/callback',\n * scopes: ['openid', 'email', 'profile']\n * }\n * }\n * });\n * ```\n * \n * @example\n * Using custom inline providers:\n * ```typescript\n * import { Lixa, IProvider } from '@vunexa/lixa';\n * \n * const customProvider: IProvider = {\n * authorizationEndpoint: 'https://custom.com/oauth/authorize',\n * tokenEndpoint: 'https://custom.com/oauth/token',\n * userInfoEndpoint: 'https://custom.com/api/user'\n * };\n * \n * const lixa = new Lixa({\n * providers: {\n * custom: {\n * provider: customProvider,\n * clientId: 'your-client-id',\n * clientSecret: 'your-client-secret',\n * redirectUri: 'https://yourapp.com/auth/custom/callback',\n * scopes: ['read:user']\n * }\n * }\n * });\n * ```\n *\n * @public\n */\nclass Lixa<TConfig extends LixaConfig<Record<string, ProviderConfig>> = LixaConfig> {\n private static DEFAULT_PROVIDERS: Map<string, IProvider> = new Map();\n private static CONFIGURED_PROVIDERS: Map<string, IProvider> = new Map(); // Legacy registry for backward compatibility\n\n // Instance-scoped fallback handlers to ensure no cross-instance state pollution\n private localStateHandler: StateHandler;\n private localSessionHandler: SessionHandler;\n private localResourceHandler: ResourceHandler;\n private userResourceStore: Map<string, Map<string, ConnectedResource>> = new Map();\n private refreshMutexes: Map<string, Promise<ConnectedResource>> = new Map();\n\n private config: TConfig;\n private stateHandler: StateHandler;\n private sessionHandler: SessionHandler;\n private resourceHandler: ResourceHandler;\n private debug: boolean;\n\n /**\n * Creates a new Lixa instance with the provided configuration.\n * \n * @remarks\n * Providers can be passed inline in the configuration using the `provider` field.\n * Provider resolution priority: inline custom provider \\> default providers \\> legacy registry.\n * \n * @param config - The configuration object containing provider settings and optional session strategy\n * \n * @throws Error when provider configuration is missing required fields\n * @throws Error when provider implementation is missing required properties\n * @throws Error when provider is not available and no inline implementation is provided\n */\n constructor(config: TConfig) {\n this.config = config;\n this.debug = config.debug || false;\n\n // Initialize instance-isolated fallback handlers\n this.localStateHandler = new LocalStateHandler();\n this.localSessionHandler = new LocalSessionHandler();\n this.localResourceHandler = {\n resourceStorage: {\n saveResource: async (userId: string, provider: string, resource: ConnectedResource) => {\n let userMap = this.userResourceStore.get(userId);\n if (!userMap) {\n userMap = new Map();\n this.userResourceStore.set(userId, userMap);\n }\n userMap.set(provider.toLowerCase(), resource);\n },\n getResource: async (userId: string, provider: string) => {\n const userMap = this.userResourceStore.get(userId);\n return userMap?.get(provider.toLowerCase()) || null;\n },\n getUserResources: async (userId: string) => {\n const userMap = this.userResourceStore.get(userId);\n const result: Record<string, ConnectedResource> = {};\n if (userMap) {\n for (const [p, r] of userMap.entries()) {\n result[p] = r;\n }\n }\n return result;\n },\n deleteResource: async (userId: string, provider: string) => {\n const userMap = this.userResourceStore.get(userId);\n if (userMap) {\n userMap.delete(provider.toLowerCase());\n }\n },\n },\n };\n\n this.stateHandler = config.stateHandler || this.localStateHandler;\n this.sessionHandler = config.sessionHandler || this.localSessionHandler;\n this.resourceHandler = config.resourceHandler || this.localResourceHandler;\n \n this.log('INFO', 'Init', 'Initializing Lixa instance', { \n providers: Object.keys(config.providers),\n debug: this.debug \n });\n \n // Validate and extract providers from configuration\n for (const [providerName, providerConfig] of Object.entries(config.providers)) {\n const name = providerName.toLowerCase();\n const typedConfig: ProviderConfig = providerConfig;\n \n // Validate provider configuration has required credentials\n this.validateProviderConfig(providerName, typedConfig);\n \n // If provider config includes a custom provider implementation, validate it\n if (typedConfig.provider) {\n this.validateProviderImplementation(providerName, typedConfig.provider);\n this.log('INFO', 'Init', `Registered inline provider: ${providerName}`);\n } else {\n // Check if it's available in default providers or legacy registry\n if (!Lixa.DEFAULT_PROVIDERS.has(name) && !Lixa.CONFIGURED_PROVIDERS.has(name)) {\n this.log('ERROR', 'Init', `Provider '${providerName}' not available`);\n throw new ProviderNotConfiguredError(\n providerName,\n { hint: `Ensure the provider is registered via '@vunexa/lixa-providers' or provided inline.` }\n );\n }\n this.log('INFO', 'Init', `Using registered provider: ${providerName}`);\n }\n }\n \n this.log('INFO', 'Init', 'Lixa instance initialized successfully');\n }\n \n /**\n * Validates that a provider configuration has all required credentials.\n * \n * @param name - The provider name\n * @param config - The provider configuration\n * @throws InvalidProviderConfigError when required fields are missing or invalid\n */\n private validateProviderConfig(name: string, config: ProviderConfig): void {\n const requiredFields: (keyof ProviderConfig)[] = ['clientId', 'clientSecret', 'redirectUri', 'scopes'];\n const missingFields = requiredFields.filter(field => {\n const value = config[field];\n return value === undefined || value === null || (typeof value === 'string' && value.trim() === '');\n });\n \n if (missingFields.length > 0) {\n throw new InvalidProviderConfigError(\n `Provider '${name}' configuration is missing required fields: ${missingFields.join(', ')}`,\n { provider: name, missingFields }\n );\n }\n \n // Validate scopes is an array\n if (!Array.isArray(config.scopes)) {\n throw new InvalidProviderConfigError(\n `Provider '${name}' configuration error: 'scopes' must be an array of strings`,\n { provider: name }\n );\n }\n \n if (config.scopes.length === 0) {\n throw new InvalidProviderConfigError(\n `Provider '${name}' configuration error: 'scopes' array cannot be empty`,\n { provider: name }\n );\n }\n }\n \n /**\n * Validates that a provider implementation has all required properties.\n * \n * @param name - The provider name\n * @param provider - The provider implementation\n * @throws InvalidProviderConfigError when required properties are missing\n */\n private validateProviderImplementation(name: string, provider: IProvider): void {\n const requiredProps: (keyof IProvider)[] = ['authorizationEndpoint', 'tokenEndpoint', 'userInfoEndpoint'];\n const missingProps = requiredProps.filter(prop => {\n const value = provider[prop];\n return !value || typeof value !== 'string' || value.trim() === '';\n });\n \n if (missingProps.length > 0) {\n throw new InvalidProviderConfigError(\n `Provider '${name}' implementation is missing required properties: ${missingProps.join(', ')}. ` +\n `All IProvider implementations must define: authorizationEndpoint, tokenEndpoint, and userInfoEndpoint.`,\n { provider: name, missingProps }\n );\n }\n }\n\n /**\n * Structured logging with standardized format and custom logger support.\n * \n * @param level - Log level (INFO, WARN, ERROR, DEBUG)\n * @param context - Context of the log (Init, Auth, Token, Session, State, AccountLinking, Resource)\n * @param message - Log message\n * @param data - Optional data to log\n */\n private log(\n level: 'INFO' | 'WARN' | 'ERROR' | 'DEBUG',\n context: 'Init' | 'Auth' | 'Token' | 'Session' | 'State' | 'AccountLinking' | 'Resource',\n message: string,\n data?: Record<string, unknown>\n ): void {\n if (this.config.logger) {\n try {\n this.config.logger.log(level, context, message, data);\n } catch {\n // Ignore custom logger exceptions\n }\n }\n\n if (!this.debug) return;\n \n const timestamp = new Date().toISOString();\n const prefix = `[Lixa] [${timestamp}] [${level}] [${context}]`;\n \n if (data !== undefined) {\n console.log(`${prefix} ${message}`, data);\n } else {\n console.log(`${prefix} ${message}`);\n }\n }\n\n /**\n * Checks if a provider is configured for this instance.\n * This is a type guard that narrows the provider type for use with getAuthUrl.\n *\n * @param provider - The provider name to check (case-insensitive)\n * @returns True if the provider is configured, false otherwise\n *\n * @example\n * ```typescript\n * if (lixa.isProviderConfigured(provider)) {\n * // TypeScript now knows provider is a valid ConfiguredProviderKey\n * const authUrl = lixa.getAuthUrl(provider, state);\n * }\n * ```\n */\n public isProviderConfigured<T extends string>(provider: T): provider is T & ConfiguredProviderKey<TConfig> {\n const providerType = provider.toLowerCase();\n return this.config.providers.hasOwnProperty(providerType);\n }\n \n /**\n * Gets a provider implementation by name.\n * Resolution priority: inline custom provider \\> default providers \\> legacy registry\n * \n * @param name - The provider name (case-insensitive)\n * @param config - The provider configuration\n * @returns The provider implementation\n * @throws Error when provider is not found\n */\n private getProvider(name: string, config: ProviderConfig): IProvider {\n // First check if provider is inline in config\n if (config.provider) {\n return config.provider;\n }\n \n // Then check default providers\n const lowerName = name.toLowerCase();\n const defaultProvider = Lixa.DEFAULT_PROVIDERS.get(lowerName);\n if (defaultProvider) {\n return defaultProvider;\n }\n \n // Finally check legacy registry for backward compatibility\n const legacyProvider = Lixa.CONFIGURED_PROVIDERS.get(lowerName);\n if (legacyProvider) {\n return legacyProvider;\n }\n \n throw new ProviderNotConfiguredError(\n name,\n { hint: `Ensure the provider is included in the configuration with a 'provider' field, or registered using Lixa.registerProvider().` }\n );\n }\n\n /**\n * Registers custom OAuth providers for use with Lixa.\n * \n * @deprecated This method is maintained for backward compatibility.\n * The recommended approach is to pass providers inline in the configuration:\n * ```typescript\n * const lixa = new Lixa({\n * providers: {\n * custom: {\n * provider: new CustomProvider(),\n * clientId: '...',\n * // ...\n * }\n * }\n * });\n * ```\n *\n * @param providerMap - A map of provider names to IProvider implementations\n *\n * @example\n * Legacy usage (still supported):\n * ```typescript\n * class CustomProvider implements IProvider {\n * authorizationEndpoint = 'https://custom.com/oauth/authorize';\n * tokenEndpoint = 'https://custom.com/oauth/token';\n * userInfoEndpoint = 'https://custom.com/api/user';\n * }\n *\n * Lixa.registerProvider({ custom: new CustomProvider() });\n * ```\n */\n public static registerProvider<T extends Record<string, IProvider>>(providerMap: T): void {\n Object.entries(providerMap).forEach(([key, providerImpl]) => {\n Lixa.CONFIGURED_PROVIDERS.set(key.toLowerCase(), providerImpl);\n });\n }\n\n /**\n * Gets the list of registered provider names.\n * \n * @returns Array of registered provider names\n */\n public static getRegisteredProviders(): string[] {\n return Array.from(Lixa.CONFIGURED_PROVIDERS.keys());\n }\n\n /**\n * Creates a type-safe configuration.\n * \n * @deprecated This method is maintained for backward compatibility.\n * You can now pass configuration directly to the Lixa constructor without this helper.\n * \n * @param config - Configuration object with provider settings\n * @returns The same configuration object with type safety\n * \n * @example\n * New approach (recommended):\n * ```typescript\n * const lixa = new Lixa({\n * providers: {\n * google: {\n * provider: new GoogleProvider(),\n * clientId: '...',\n * // ...\n * }\n * }\n * });\n * ```\n */\n public static createConfig<T extends Record<string, ProviderConfig>>(\n config: LixaConfig<T> & { providers: T }\n ): LixaConfig<T> {\n return config;\n }\n\n /**\n * Generates a cryptographically secure random state parameter for OAuth flows.\n *\n * @returns A 32-character hexadecimal string\n *\n * @remarks\n * The state parameter is used to prevent CSRF attacks in OAuth flows.\n */\n public static generateRandomState(): string {\n return randomBytes(16).toString(\"hex\");\n }\n\n /**\n * Generates a cryptographically secure code verifier for PKCE flows.\n *\n * @returns A 64-character hexadecimal string (32 random bytes encoded as hex)\n *\n * @remarks\n * This method implements the code verifier generation as specified in RFC 7636 (PKCE).\n * \n * **PKCE (Proof Key for Code Exchange)** is a security extension to OAuth 2.0 that\n * prevents authorization code interception attacks. It's especially important for\n * public clients (mobile apps, SPAs) but is recommended for all OAuth flows.\n * \n * **Generation methodology:**\n * 1. Generate 32 cryptographically random bytes using Node.js crypto.randomBytes()\n * 2. Encode the bytes as a hexadecimal string (64 characters)\n * 3. The verifier is stored securely and used later in the token exchange\n * \n * **RFC 7636 Requirements:**\n * - Minimum length: 43 characters\n * - Maximum length: 128 characters\n * - Character set: [A-Z] / [a-z] / [0-9] / \"-\" / \".\" / \"_\" / \"~\"\n * - This implementation produces 64 hex characters, meeting the requirements\n * \n * The code verifier is:\n * - Generated when creating the authorization URL\n * - Stored in state cache with the state parameter\n * - Retrieved during callback handling\n * - Sent to the token endpoint to prove the client's identity\n * \n * @see {@link https://datatracker.ietf.org/doc/html/rfc7636 | RFC 7636 - PKCE}\n * @see buildCodeChallenge for the corresponding challenge generation\n * \n * @internal\n */\n private static generateCodeVerifier(): string {\n return randomBytes(32).toString(\"hex\");\n }\n\n /**\n * Generates a code challenge from a code verifier for PKCE flows.\n *\n * @param codeVerifier - The code verifier string (64 hex characters)\n * @returns A base64url-encoded SHA-256 hash of the code verifier\n *\n * @remarks\n * This method implements the code challenge generation as specified in RFC 7636 (PKCE)\n * using the S256 (SHA-256) transformation method.\n * \n * **Challenge generation methodology:**\n * 1. Hash the code verifier using SHA-256\n * 2. Encode the hash as base64\n * 3. Convert to base64url format (RFC 4648):\n * - Replace '+' with '-'\n * - Replace '/' with '_'\n * - Remove trailing '=' padding\n * \n * **PKCE Flow:**\n * 1. Client generates code_verifier (random string)\n * 2. Client creates code_challenge = BASE64URL(SHA256(code_verifier))\n * 3. Client sends code_challenge to authorization endpoint\n * 4. Authorization server stores the code_challenge\n * 5. Client sends code_verifier to token endpoint\n * 6. Authorization server verifies: SHA256(code_verifier) == code_challenge\n * \n * **Security Benefits:**\n * - Prevents authorization code interception attacks\n * - Even if an attacker intercepts the authorization code, they cannot\n * exchange it for tokens without the original code_verifier\n * - The challenge is sent in the authorization request (public)\n * - The verifier is sent in the token request (should be kept secret)\n * \n * **RFC 7636 Transformation Methods:**\n * - plain: code_challenge = code_verifier (not recommended)\n * - S256: code_challenge = BASE64URL(SHA256(code_verifier)) (recommended, used here)\n * \n * @see {@link https://datatracker.ietf.org/doc/html/rfc7636 | RFC 7636 - PKCE}\n * @see {@link https://datatracker.ietf.org/doc/html/rfc4648#section-5 | RFC 4648 - Base64url Encoding}\n * @see generateCodeVerifier for the verifier generation\n * \n * @internal\n */\n private static buildCodeChallenge(codeVerifier: string): string {\n const hash = crypto\n .createHash(\"sha256\")\n .update(codeVerifier)\n .digest(\"base64\");\n\n // Convert to base64url (RFC 4648 Section 5)\n return hash.replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n }\n\n /**\n * Generates the authorization URL for the specified provider.\n *\n * @param provider - The provider name (must be a configured provider key)\n * @param state - The state parameter for CSRF protection\n * @returns The complete authorization URL to redirect users to\n *\n * @throws Error when the provider is not configured\n *\n * @example\n * ```typescript\n * const state = Lixa.generateRandomState();\n * const authUrl = lixa.getAuthUrl('google', state);\n * res.redirect(authUrl);\n * ```\n */\n public async getAuthUrl(provider: ConfiguredProviderKey<TConfig> | string, state?: string): Promise<string> {\n const providerType = String(provider).toLowerCase();\n \n this.log('INFO', 'Auth', `Generating authorization URL for provider: ${providerType}`);\n \n const providerConfig = this.findProviderByType(providerType);\n\n if (!providerConfig) {\n this.log('ERROR', 'Auth', `Provider '${String(provider)}' is not configured`);\n throw new ProviderNotConfiguredError(String(provider), {\n message: `Provider '${String(provider)}' is not configured in this Lixa instance`,\n });\n }\n\n const providerImpl = this.getProvider(providerType, providerConfig);\n\n // Generate state and code verifier\n let stateValue: string;\n let codeVerifier: string;\n \n const generateStateFn = this.stateHandler.generateState || this.stateHandler.GenerateState;\n if (generateStateFn) {\n this.log('INFO', 'State', 'Calling custom generateState');\n const generated = await generateStateFn(providerType);\n stateValue = state || generated.state;\n codeVerifier = generated.data.codeVerifier;\n \n // Save the generated state data\n const storage = this.stateHandler.stateStorage || this.localStateHandler.stateStorage!;\n await storage.saveState(stateValue, generated.data, 300);\n } else {\n this.log('INFO', 'State', 'Using default state generation');\n stateValue = state || randomBytes(16).toString(\"hex\");\n codeVerifier = randomBytes(32).toString(\"hex\");\n \n // Save state with default implementation\n const storage = this.stateHandler.stateStorage || this.localStateHandler.stateStorage!;\n await storage.saveState(\n stateValue,\n {\n createdAt: Date.now(),\n provider: providerType,\n codeVerifier,\n },\n 300 // 5 minutes in seconds (synchronized with cookie TTL)\n );\n }\n\n const codeChallenge = Lixa.buildCodeChallenge(codeVerifier);\n\n this.log('INFO', 'State', `Saved state for provider: ${providerType}`, { state: stateValue });\n\n const authNScopes = this.resolveAuthNScopes(\n providerType,\n providerConfig.scopes,\n providerImpl,\n providerConfig.allowNonAuthScopes\n );\n\n const params = new URLSearchParams({\n client_id: providerConfig.clientId,\n redirect_uri: providerConfig.redirectUri,\n scope: authNScopes.join(\" \"),\n state: stateValue,\n response_type: \"code\",\n code_challenge: codeChallenge,\n code_challenge_method: \"S256\",\n ...providerConfig.extraConfig,\n });\n\n const authUrl = `${providerImpl.authorizationEndpoint}?${params.toString()}`;\n this.log('INFO', 'Auth', `Authorization URL generated successfully`, { \n provider: providerType,\n endpoint: providerImpl.authorizationEndpoint \n });\n\n return authUrl;\n }\n\n /**\n * Restricts primary authentication scopes strictly to AuthN identity scopes unless allowNonAuthScopes is true.\n */\n private resolveAuthNScopes(\n providerType: string,\n configuredScopes: string[],\n providerImpl: IProvider,\n allowNonAuthScopes?: boolean\n ): string[] {\n if (allowNonAuthScopes) {\n return configuredScopes && configuredScopes.length > 0\n ? configuredScopes\n : providerImpl.authScopes || [\"openid\", \"email\", \"profile\"];\n }\n\n const defaultAuthScopes: Record<string, string[]> = {\n google: [\"openid\", \"email\", \"profile\"],\n github: [\"read:user\", \"user:email\"],\n microsoft: [\"openid\", \"email\", \"profile\"],\n };\n\n const standardAuthNScopes = [\n \"openid\",\n \"email\",\n \"profile\",\n \"read:user\",\n \"user:email\",\n \"read:email\",\n \"user:profile\",\n \"user\",\n ];\n\n const allowedAuthNScopes = new Set<string>([\n ...standardAuthNScopes,\n ...(providerImpl.authScopes || []),\n ...(defaultAuthScopes[providerType] || []),\n ]);\n\n const validAuthNScopes = (configuredScopes || []).filter((scope) => allowedAuthNScopes.has(scope));\n const nonAuthNScopes = (configuredScopes || []).filter((scope) => !allowedAuthNScopes.has(scope));\n\n if (nonAuthNScopes.length > 0) {\n this.log(\n \"WARN\",\n \"Auth\",\n `Primary authentication is strictly limited to AuthN scopes. Excluded non-AuthN resource scopes: [${nonAuthNScopes.join(\n \", \"\n )}]. Set 'allowNonAuthScopes: true' on provider config to include them, or use lixa.getResourceAuthUrl() post-login to connect resource providers.`\n );\n }\n\n if (validAuthNScopes.length > 0) {\n return validAuthNScopes;\n }\n\n return providerImpl.authScopes || defaultAuthScopes[providerType] || [\"openid\", \"email\", \"profile\"];\n }\n\n /**\n * Handles the OAuth callback and creates a user session.\n *\n * @param provider - The provider name (must be a configured provider key)\n * @param code - The authorization code from the provider\n * @param state - The state parameter for validation\n * @returns A Promise that resolves to the session ID\n *\n * @throws Error when code or state is missing/invalid, or provider is not configured\n *\n * @example\n * ```typescript\n * const sessionId = await lixa.handleCallback({\n * provider: 'google',\n * code: req.query.code,\n * state: req.query.state\n * });\n * ```\n */\n public async handleCallback({\n provider,\n code,\n state,\n }: {\n provider: ConfiguredProviderKey<TConfig> | string;\n code: string;\n state?: string;\n }): Promise<string> {\n const providerType = String(provider).toLowerCase();\n this.log('INFO', 'Auth', `Handling OAuth callback for provider: ${providerType}`);\n\n if (!code || code.trim() === \"\") {\n this.log('ERROR', 'Auth', 'Invalid or missing authorization code in callback');\n throw new InvalidOAuthCallbackError(\"Invalid or missing code in callback\");\n }\n\n if (!state || state.trim() === \"\") {\n this.log('ERROR', 'Auth', 'Invalid or missing state in callback');\n throw new InvalidOAuthCallbackError(\"Invalid or missing state in callback\");\n }\n\n this.log('INFO', 'State', 'Validating state parameter', { state });\n\n //Validate state here\n const stateStorage = this.stateHandler.stateStorage || this.localStateHandler.stateStorage!;\n const cachedState = await stateStorage.getState(state);\n if (!cachedState) {\n this.log('ERROR', 'State', 'State validation failed: state not found or expired', { state });\n throw new InvalidStateError(\"Invalid or expired state\", { state });\n }\n \n this.log('INFO', 'State', 'State validated successfully, removing from cache');\n // State is valid, remove it from cache to prevent reuse\n await stateStorage.deleteState(state);\n\n //Get code verifier from cached state\n const codeVerifier = cachedState.codeVerifier;\n\n const providerConfig = this.findProviderByType(providerType);\n\n if (!providerConfig) {\n this.log('ERROR', 'Auth', `Provider '${String(provider)}' is not configured`);\n throw new ProviderNotConfiguredError(String(provider), {\n message: `Provider '${String(provider)}' is not configured in this Lixa instance`,\n });\n }\n\n const providerImpl = this.getProvider(providerType, providerConfig);\n\n this.log('INFO', 'Token', `Exchanging authorization code for tokens`, { provider: providerType });\n\n // Exchange code for tokens and fetch user info here.\n const tokens = await this.exchangeCodeForToken(\n code,\n providerConfig,\n providerImpl,\n codeVerifier\n );\n\n this.log('INFO', 'Token', 'Token exchange successful');\n this.log('INFO', 'Session', 'Generating user session');\n \n // Create provider metadata for session generation\n const providerMetadata: ProviderMetadata = {\n name: providerType,\n endpoints: {\n authorization: providerImpl.authorizationEndpoint,\n token: providerImpl.tokenEndpoint,\n userInfo: providerImpl.userInfoEndpoint\n }\n };\n\n // Extract user info if possible for account linking & session population\n let extractedUserInfo: UserInfo | undefined;\n try {\n const { userInfo } = await extractUserInfo(tokens, providerMetadata);\n extractedUserInfo = userInfo;\n } catch {\n // User info extraction might fail if scopes are limited or provider requires special handling\n }\n \n // Generate session data\n const generateSession =\n this.sessionHandler.generateSession ||\n this.sessionHandler.GenerateSession ||\n (this.localSessionHandler.generateSession ? this.localSessionHandler.generateSession.bind(this.localSessionHandler) : undefined);\n\n if (!generateSession) {\n throw new Error(\"No session generation handler available\");\n }\n \n if (this.sessionHandler.generateSession || this.sessionHandler.GenerateSession) {\n this.log('INFO', 'Session', 'Calling custom generateSession');\n } else {\n this.log('INFO', 'Session', 'Using default session generation');\n }\n \n const session = await generateSession(tokens, providerMetadata);\n session.provider = session.provider || providerType;\n if (extractedUserInfo?.email && !session.email) {\n session.email = extractedUserInfo.email;\n }\n\n const sessionStorage = this.sessionHandler.sessionStorage || this.localSessionHandler.sessionStorage!;\n\n // Account Linking Mode: AccountLinkingStrategy.AUTO_LINK_BY_VERIFIED_EMAIL\n const linkingConfig = this.config.accountLinking;\n const mode = String(linkingConfig?.mode || \"\");\n const isLinkByEmail =\n mode === AccountLinkingStrategy.AUTO_LINK_BY_VERIFIED_EMAIL ||\n mode === \"AUTO_LINK_BY_VERIFIED_EMAIL\" ||\n mode === \"linkByEmail\";\n const email = extractedUserInfo?.email;\n const isVerified = extractedUserInfo?.email_verified !== false;\n const requireVerified = linkingConfig?.requireVerifiedEmail ?? true;\n const canLink = isLinkByEmail && email && (!requireVerified || isVerified);\n\n if (canLink && sessionStorage.getSessionByEmail) {\n const existingRecord = await sessionStorage.getSessionByEmail(email);\n if (existingRecord) {\n this.log('INFO', 'AccountLinking', `Linking provider '${providerType}' to existing session for email '${email}'`);\n const { sessionId: existingSessionId, session: existingSession } = existingRecord;\n \n existingSession.accounts = existingSession.accounts || {};\n existingSession.accounts[providerType] = {\n provider: providerType,\n providerUserId: extractedUserInfo?.sub || extractedUserInfo?.id,\n email,\n accessToken: tokens.access_token,\n raw: tokens,\n linkedAt: Date.now(),\n };\n existingSession.provider = providerType;\n existingSession.token = tokens.access_token;\n existingSession.raw = tokens;\n\n await sessionStorage.saveSession(existingSessionId, existingSession, 86400);\n return existingSessionId;\n }\n }\n\n // Default / Separate Account Mode\n session.accounts = session.accounts || {};\n session.accounts[providerType] = {\n provider: providerType,\n providerUserId: extractedUserInfo?.sub || extractedUserInfo?.id,\n email: extractedUserInfo?.email,\n accessToken: tokens.access_token,\n raw: tokens,\n linkedAt: Date.now(),\n };\n\n // Generate unique session ID\n const sessionId = randomBytes(32).toString(\"hex\");\n session.id = sessionId;\n\n this.log('INFO', 'Session', 'Storing session', { sessionId });\n await sessionStorage.saveSession(sessionId, session, 86400);\n\n this.log('INFO', 'Session', 'Session created successfully', { sessionId });\n\n return sessionId;\n }\n\n /**\n * Explicitly link a new OAuth provider account to an active session.\n * \n * @param params - Object containing sessionId, provider, code, and optional state\n * @returns The active session ID with the newly linked provider\n */\n public async linkAccount(params: {\n sessionId: string;\n provider: ConfiguredProviderKey<TConfig> | string;\n code: string;\n state?: string;\n }): Promise<string> {\n const { sessionId, provider, code, state } = params;\n const sessionStorage = this.sessionHandler.sessionStorage || this.localSessionHandler.sessionStorage!;\n const existingSession = await sessionStorage.getSession(sessionId);\n\n if (!existingSession) {\n throw new SessionNotFoundError(\"Invalid session ID. User must be authenticated to link an account.\", { sessionId });\n }\n\n if (!code || code.trim() === \"\") {\n throw new InvalidOAuthCallbackError(\"Invalid or missing code in linkAccount\");\n }\n\n const providerType = String(provider).toLowerCase();\n const providerConfig = this.findProviderByType(providerType);\n if (!providerConfig) {\n throw new ProviderNotConfiguredError(String(provider));\n }\n const providerImpl = this.getProvider(providerType, providerConfig);\n\n // Validate state and extract code verifier if state is provided\n let codeVerifier: string | undefined;\n if (state) {\n const stateStorage = this.stateHandler.stateStorage || this.localStateHandler.stateStorage!;\n const cachedState = await stateStorage.getState(state);\n if (!cachedState) {\n throw new InvalidStateError(\"Invalid or expired state during account linking\", { state });\n }\n codeVerifier = cachedState.codeVerifier;\n await stateStorage.deleteState(state);\n }\n\n // Exchange authorization code for tokens (Passing code correctly)\n const tokens = await this.exchangeCodeForToken(code, providerConfig, providerImpl, codeVerifier || \"\");\n\n const providerMetadata: ProviderMetadata = {\n name: providerType,\n endpoints: {\n authorization: providerImpl.authorizationEndpoint,\n token: providerImpl.tokenEndpoint,\n userInfo: providerImpl.userInfoEndpoint,\n },\n };\n\n let extractedUserInfo: UserInfo | undefined;\n try {\n const { userInfo } = await extractUserInfo(tokens, providerMetadata);\n extractedUserInfo = userInfo;\n } catch {\n // User info extraction optional\n }\n\n existingSession.accounts = existingSession.accounts || {};\n existingSession.accounts[providerType] = {\n provider: providerType,\n providerUserId: extractedUserInfo?.sub || extractedUserInfo?.id,\n email: extractedUserInfo?.email,\n accessToken: tokens.access_token,\n raw: tokens,\n linkedAt: Date.now(),\n };\n\n if (extractedUserInfo?.email && !existingSession.email) {\n existingSession.email = extractedUserInfo.email;\n }\n\n await sessionStorage.saveSession(sessionId, existingSession, 86400);\n return sessionId;\n }\n\n /**\n * Unlinks an OAuth provider account from an active session.\n * \n * @param sessionId - Active session ID\n * @param providerToUnlink - Provider name to unlink (e.g. 'github')\n * @returns Promise resolving to true on successful unlink\n */\n public async unlinkAccount(sessionId: string, providerToUnlink: string): Promise<boolean> {\n const sessionStorage = this.sessionHandler.sessionStorage || this.localSessionHandler.sessionStorage!;\n const session = await sessionStorage.getSession(sessionId);\n\n if (!session || !session.accounts) {\n throw new AccountUnlinkError(\"Session not found or has no linked accounts.\", { sessionId });\n }\n\n const linkedProviders = Object.keys(session.accounts);\n if (linkedProviders.length <= 1) {\n throw new AccountUnlinkError(\"Cannot unlink the only authentication provider for this account.\", {\n sessionId,\n provider: providerToUnlink,\n });\n }\n\n delete session.accounts[providerToUnlink.toLowerCase()];\n await sessionStorage.saveSession(sessionId, session, 86400);\n return true;\n }\n\n /**\n * Generates an authorization URL for connecting a resource provider (AuthZ) post-login.\n * \n * @remarks\n * Resource authorization is kept strictly separate from primary authentication (AuthN).\n * Call this method after a user is authenticated to request permissions for external API access\n * (e.g. GitHub repositories, Google Drive, Slack, etc.).\n * \n * @param params - Object containing sessionId, provider, requested resource scopes, and optional state\n * @returns The authorization URL for resource consent\n */\n public async getResourceAuthUrl(params: {\n sessionId: string;\n provider: ConfiguredProviderKey<TConfig> | string;\n scopes: string[];\n state?: string;\n prompt?: string;\n extraConfig?: Record<string, string>;\n }): Promise<string> {\n const { sessionId, provider, scopes, state, prompt, extraConfig } = params;\n const sessionStorage = this.sessionHandler.sessionStorage || this.localSessionHandler.sessionStorage!;\n const activeSession = await sessionStorage.getSession(sessionId);\n\n if (!activeSession) {\n throw new SessionNotFoundError(\"Authentication required. Active session must exist to connect resource providers.\", { sessionId });\n }\n\n const providerType = String(provider).toLowerCase();\n const providerConfig = this.findProviderByType(providerType);\n if (!providerConfig) {\n throw new ProviderNotConfiguredError(String(provider));\n }\n\n const providerImpl = this.getProvider(providerType, providerConfig);\n const stateValue = state || randomBytes(16).toString(\"hex\");\n const codeVerifier = randomBytes(32).toString(\"hex\");\n\n const storage = this.stateHandler.stateStorage || this.localStateHandler.stateStorage!;\n await storage.saveState(\n stateValue,\n {\n createdAt: Date.now(),\n provider: providerType,\n codeVerifier,\n },\n 300\n );\n\n const codeChallenge = Lixa.buildCodeChallenge(codeVerifier);\n\n const searchParams = new URLSearchParams({\n client_id: providerConfig.clientId,\n redirect_uri: providerConfig.redirectUri,\n scope: scopes.join(\" \"),\n state: stateValue,\n response_type: \"code\",\n code_challenge: codeChallenge,\n code_challenge_method: \"S256\",\n ...(prompt ? { prompt } : {}),\n ...providerConfig.extraConfig,\n ...extraConfig,\n });\n\n return `${providerImpl.authorizationEndpoint}?${searchParams.toString()}`;\n }\n\n private getUserKeyFromSession(session: Session): string {\n return session.userId || session.email || session.id || \"anonymous\";\n }\n\n /**\n * Handles the OAuth callback for a connected resource provider and stores resource tokens bound to user account.\n */\n public async handleResourceCallback(params: {\n sessionId: string;\n provider: ConfiguredProviderKey<TConfig> | string;\n code: string;\n state?: string;\n scopes?: string[];\n }): Promise<Session> {\n const { sessionId, provider, code, state, scopes } = params;\n const sessionStorage = this.sessionHandler.sessionStorage || this.localSessionHandler.sessionStorage!;\n const activeSession = await sessionStorage.getSession(sessionId);\n\n if (!activeSession) {\n throw new SessionNotFoundError(\"Authentication required. Active session not found for resource connection.\", { sessionId });\n }\n\n const providerType = String(provider).toLowerCase();\n const providerConfig = this.findProviderByType(providerType);\n if (!providerConfig) {\n throw new ProviderNotConfiguredError(String(provider));\n }\n const providerImpl = this.getProvider(providerType, providerConfig);\n\n let codeVerifier = randomBytes(32).toString(\"hex\");\n if (state) {\n const stateStorage = this.stateHandler.stateStorage || this.localStateHandler.stateStorage!;\n const cachedState = await stateStorage.getState(state);\n if (!cachedState) {\n throw new InvalidStateError(\"Invalid or expired state during resource connection callback\", { state });\n }\n codeVerifier = cachedState.codeVerifier;\n await stateStorage.deleteState(state);\n }\n\n const tokens = await this.exchangeCodeForToken(code, providerConfig, providerImpl, codeVerifier);\n const expiresAt = tokens.expires_in ? Date.now() + tokens.expires_in * 1000 : undefined;\n\n const connectedResource: ConnectedResource = {\n provider: providerType,\n accessToken: tokens.access_token,\n refreshToken: tokens.refresh_token,\n expiresAt,\n scopes: scopes || (tokens.scope ? tokens.scope.split(\" \") : []),\n raw: tokens,\n connectedAt: Date.now(),\n };\n\n // Save to persistent ResourceStorage bound to User ID / Email\n const userKey = this.getUserKeyFromSession(activeSession);\n const resourceStorage = this.resourceHandler.resourceStorage || this.localResourceHandler.resourceStorage!;\n await resourceStorage.saveResource(userKey, providerType, connectedResource);\n\n // Attach to active session for session context\n activeSession.resources = activeSession.resources || {};\n activeSession.resources[providerType] = connectedResource;\n await sessionStorage.saveSession(sessionId, activeSession, 86400);\n\n return activeSession;\n }\n\n /**\n * Retrieves a connected resource for a specific User ID / Email directly (independent of session IDs).\n * Automatically refreshes expired access tokens if a refresh token is present.\n * \n * @param userIdOrEmail - User identifier or email\n * @param provider - Resource provider identifier (e.g. 'github', 'google')\n */\n public async getUserResource(userIdOrEmail: string, provider: string): Promise<ConnectedResource | null> {\n const resourceStorage = this.resourceHandler.resourceStorage || this.localResourceHandler.resourceStorage!;\n const providerType = provider.toLowerCase();\n const resource = await resourceStorage.getResource(userIdOrEmail, providerType);\n if (!resource) return null;\n\n // Auto-refresh token if expired (or expiring in < 60 seconds) and refreshToken is available\n if (resource.refreshToken && resource.expiresAt && Date.now() >= resource.expiresAt - 60000) {\n this.log('INFO', 'Token', `Resource access token for user '${userIdOrEmail}' on '${providerType}' is expired. Auto-refreshing...`);\n try {\n return await this.refreshUserResourceToken(userIdOrEmail, providerType);\n } catch (error) {\n this.log('ERROR', 'Token', `Failed to auto-refresh resource token for user '${userIdOrEmail}' on '${providerType}'`, { error: String(error) });\n }\n }\n\n return resource;\n }\n\n /**\n * Retrieves all connected resources for a specific User ID / Email.\n */\n public async getUserResources(userIdOrEmail: string): Promise<Record<string, ConnectedResource>> {\n const resourceStorage = this.resourceHandler.resourceStorage || this.localResourceHandler.resourceStorage!;\n return await resourceStorage.getUserResources(userIdOrEmail);\n }\n\n /**\n * Retrieves a connected resource provider token for an active session, auto-refreshing expired tokens if possible.\n * \n * @param sessionId - Active session ID\n * @param provider - Provider identifier (e.g. 'github', 'google')\n */\n public async getConnectedResource(sessionId: string, provider: string): Promise<ConnectedResource | null> {\n const sessionStorage = this.sessionHandler.sessionStorage || this.localSessionHandler.sessionStorage!;\n const activeSession = await sessionStorage.getSession(sessionId);\n if (!activeSession) return null;\n\n const providerType = provider.toLowerCase();\n const userKey = this.getUserKeyFromSession(activeSession);\n \n // 1. Try to fetch from persistent ResourceStorage by user key\n let resource = await this.getUserResource(userKey, providerType);\n\n // 2. Fallback to active session resource cache if available\n if (!resource && activeSession.resources) {\n resource = activeSession.resources[providerType] || null;\n }\n\n if (resource) {\n // Auto-refresh token if expired (or expiring in < 60 seconds) and refreshToken is available\n if (resource.refreshToken && resource.expiresAt && Date.now() >= resource.expiresAt - 60000) {\n this.log('INFO', 'Token', `Resource access token for user '${userKey}' on '${providerType}' is expired. Auto-refreshing...`);\n try {\n resource = await this.refreshResourceToken(sessionId, providerType);\n } catch (error) {\n this.log('ERROR', 'Token', `Failed to auto-refresh resource token for user '${userKey}' on '${providerType}'`, { error: String(error) });\n }\n }\n\n activeSession.resources = activeSession.resources || {};\n activeSession.resources[providerType] = resource;\n }\n\n return resource;\n }\n\n /**\n * Refreshes a user's resource access token using its refresh token.\n * Deduplicates concurrent refresh requests via an in-flight promise mutex.\n * \n * @param userIdOrEmail - User identifier or email\n * @param provider - Provider identifier (e.g. 'google', 'github')\n */\n public async refreshUserResourceToken(\n userIdOrEmail: string,\n provider: string,\n existingResource?: ConnectedResource\n ): Promise<ConnectedResource> {\n const mutexKey = `${userIdOrEmail.toLowerCase()}:${provider.toLowerCase()}`;\n const existingPromise = this.refreshMutexes.get(mutexKey);\n if (existingPromise) {\n this.log('INFO', 'Token', `Concurrent refresh request detected for '${mutexKey}'. Reusing in-flight promise.`);\n return existingPromise;\n }\n\n const refreshPromise = this.executeRefreshUserResourceToken(userIdOrEmail, provider, existingResource)\n .finally(() => {\n this.refreshMutexes.delete(mutexKey);\n });\n\n this.refreshMutexes.set(mutexKey, refreshPromise);\n return refreshPromise;\n }\n\n /**\n * Internal execution of refresh token exchange.\n */\n private async executeRefreshUserResourceToken(\n userIdOrEmail: string,\n provider: string,\n existingResource?: ConnectedResource\n ): Promise<ConnectedResource> {\n const resourceStorage = this.resourceHandler.resourceStorage || this.localResourceHandler.resourceStorage!;\n const providerType = provider.toLowerCase();\n let resource = existingResource || (await resourceStorage.getResource(userIdOrEmail, providerType));\n\n if (!resource || !resource.refreshToken) {\n throw new RefreshTokenError(\n `No refresh token available for user '${userIdOrEmail}' on connected resource '${provider}'`,\n { userId: userIdOrEmail, provider }\n );\n }\n\n const providerConfig = this.findProviderByType(providerType);\n if (!providerConfig) {\n throw new ProviderNotConfiguredError(provider);\n }\n const providerImpl = this.getProvider(providerType, providerConfig);\n\n const body: Record<string, string> = {\n client_id: providerConfig.clientId,\n client_secret: providerConfig.clientSecret,\n grant_type: \"refresh_token\",\n refresh_token: resource.refreshToken,\n };\n\n const response = await fetch(providerImpl.tokenEndpoint, {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n Accept: \"application/json\",\n },\n body: new URLSearchParams(body).toString(),\n });\n\n if (!response.ok) {\n const errorText = await response.text();\n throw new RefreshTokenError(\n `Failed to refresh resource token for user '${userIdOrEmail}' on '${provider}': ${response.status} - ${errorText}`,\n { userId: userIdOrEmail, provider, status: response.status }\n );\n }\n\n const tokens: OAuthTokenResponse = await response.json();\n const expiresAt = tokens.expires_in ? Date.now() + tokens.expires_in * 1000 : undefined;\n\n resource.accessToken = tokens.access_token;\n if (tokens.refresh_token) {\n resource.refreshToken = tokens.refresh_token;\n }\n if (expiresAt) {\n resource.expiresAt = expiresAt;\n }\n resource.raw = tokens;\n resource.connectedAt = Date.now();\n\n await resourceStorage.saveResource(userIdOrEmail, providerType, resource);\n return resource;\n }\n\n /**\n * Refreshes a connected resource access token for an active session.\n */\n public async refreshResourceToken(sessionId: string, provider: string): Promise<ConnectedResource> {\n const sessionStorage = this.sessionHandler.sessionStorage || this.localSessionHandler.sessionStorage!;\n const activeSession = await sessionStorage.getSession(sessionId);\n if (!activeSession) {\n throw new SessionNotFoundError(\"Active session not found.\", { sessionId });\n }\n const providerType = provider.toLowerCase();\n const userKey = this.getUserKeyFromSession(activeSession);\n const existingResource = activeSession.resources ? activeSession.resources[providerType] : undefined;\n\n const refreshed = await this.refreshUserResourceToken(userKey, providerType, existingResource);\n activeSession.resources = activeSession.resources || {};\n activeSession.resources[providerType] = refreshed;\n await sessionStorage.saveSession(sessionId, activeSession, 86400);\n return refreshed;\n }\n\n /**\n * Disconnects a resource provider for a specific User ID / Email.\n */\n public async disconnectUserResource(userIdOrEmail: string, provider: string): Promise<boolean> {\n const resourceStorage = this.resourceHandler.resourceStorage || this.localResourceHandler.resourceStorage!;\n await resourceStorage.deleteResource(userIdOrEmail, provider.toLowerCase());\n return true;\n }\n\n /**\n * Disconnects a resource provider from an active session and user account.\n */\n public async disconnectResource(sessionId: string, provider: string): Promise<boolean> {\n const sessionStorage = this.sessionHandler.sessionStorage || this.localSessionHandler.sessionStorage!;\n const activeSession = await sessionStorage.getSession(sessionId);\n if (activeSession) {\n const userKey = this.getUserKeyFromSession(activeSession);\n await this.disconnectUserResource(userKey, provider);\n if (activeSession.resources) {\n delete activeSession.resources[provider.toLowerCase()];\n await sessionStorage.saveSession(sessionId, activeSession, 86400);\n }\n return true;\n }\n return false;\n }\n\n /**\n * Retrieves active session details from session storage.\n */\n public async fetchSessionInfo(sessionId: string): Promise<Session | null> {\n const sessionStorage = this.sessionHandler.sessionStorage || this.localSessionHandler.sessionStorage!;\n return await sessionStorage.getSession<Session>(sessionId);\n }\n\n /**\n * Deletes a session from session storage (e.g. on logout).\n * \n * @param sessionId - Active session identifier\n */\n public async deleteSession(sessionId: string): Promise<void> {\n const sessionStorage = this.sessionHandler.sessionStorage || this.localSessionHandler.sessionStorage!;\n await sessionStorage.deleteSession(sessionId);\n }\n\n private async exchangeCodeForToken(\n code: string,\n providerConfig: ProviderConfig,\n providerImpl: IProvider,\n codeVerifier: string\n ): Promise<OAuthTokenResponse> {\n // Build the request body\n const body: Record<string, string> = {\n client_id: providerConfig.clientId,\n client_secret: providerConfig.clientSecret,\n code,\n redirect_uri: providerConfig.redirectUri,\n grant_type: \"authorization_code\",\n };\n\n if (codeVerifier) {\n body.code_verifier = codeVerifier;\n }\n const params = new URLSearchParams(body);\n\n this.log('INFO', 'Token', 'Sending token exchange request', { \n endpoint: providerImpl.tokenEndpoint \n });\n \n const response = await fetch(providerImpl.tokenEndpoint, {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n Accept: \"application/json\",\n },\n body: params.toString(),\n });\n\n if (!response.ok) {\n const errorBody = await response.text();\n this.log('ERROR', 'Token', 'Token exchange failed', { \n status: response.status, \n statusText: response.statusText,\n error: errorBody \n });\n throw new TokenExchangeError(\n `Token exchange failed: ${response.status} ${response.statusText} - ${errorBody}`,\n response.status,\n { statusText: response.statusText, errorBody }\n );\n }\n\n this.log('INFO', 'Token', 'Token exchange response received successfully');\n return response.json();\n }\n\n private findProviderByType(providerType: string): ProviderConfig | undefined {\n // Use Object.entries to safely iterate and find the provider\n for (const [key, value] of Object.entries(this.config.providers)) {\n if (key.toLowerCase() === providerType.toLowerCase()) {\n return value;\n }\n }\n return undefined;\n }\n}\n\nexport { Lixa };\n","import { SessionHandler, SessionStorage, ResourceHandler, ResourceStorage, StateHandler, StateStorage, StateData } from \"./dao/types\";\nimport { Session, ProviderMetadata } from \"./models/session\";\nimport { IProvider } from \"./providers/IProvider\";\n\n// Re-export types for external use\nexport { Session, ConnectedResource } from \"./models/session\";\nexport { ProviderMetadata };\nexport { OAuthTokenResponse } from \"./models/session\";\nexport { IProvider };\nexport { StateHandler };\nexport { StateStorage };\nexport { SessionHandler };\nexport { SessionStorage };\nexport { ResourceHandler };\nexport { ResourceStorage };\nexport { StateData };\n\n/**\n * Configuration for an OAuth provider instance.\n * \n * @remarks\n * For built-in providers (google, github), just provide credentials.\n * For custom providers, include the provider implementation.\n * \n * The provider field uses a discriminated union to ensure type safety:\n * - When omitted or undefined: assumes a built-in provider\n * - When provided: must be a valid IProvider implementation\n * \n * @example\n * Built-in provider configuration:\n * ```typescript\n * {\n * clientId: 'your-client-id',\n * clientSecret: 'your-client-secret',\n * redirectUri: 'https://app.com/callback',\n * scopes: ['openid', 'email']\n * }\n * ```\n * \n * @example\n * Custom provider configuration:\n * ```typescript\n * {\n * provider: new CustomProvider(),\n * clientId: 'your-client-id',\n * clientSecret: 'your-client-secret',\n * redirectUri: 'https://app.com/callback',\n * scopes: ['read:user']\n * }\n * ```\n *\n * @public\n */\nexport type ProviderConfig = {\n /** The OAuth client ID provided by the provider */\n clientId: string;\n \n /** The OAuth client secret provided by the provider */\n clientSecret: string;\n \n /** The redirect URI registered with the provider */\n redirectUri: string;\n \n /** Array of OAuth scopes to request */\n scopes: string[];\n\n /** \n * Set to true to allow non-identity (resource) scopes during primary authentication flow.\n * By default (false), Lixa restricts primary AuthN scopes to identity scopes to maintain\n * clean AuthN vs AuthZ separation.\n */\n allowNonAuthScopes?: boolean;\n \n /** Additional provider-specific configuration parameters */\n extraConfig?: Record<string, string>;\n} & (\n | { provider?: never } // Built-in provider (no provider field needed)\n | { provider: IProvider } // Custom provider (provider field required)\n);\n\n/**\n * Main configuration object for Lixa.\n * Provides type-safe provider name inference.\n * \n * @remarks\n * The generic type parameter TProviders enables TypeScript to infer provider names\n * from the configuration object, providing autocomplete and type checking for\n * provider names in methods like getAuthUrl() and handleCallback().\n * \n * @typeParam TProviders - The provider configuration map type, defaults to a generic record\n * \n * @example\n * Basic configuration with built-in providers:\n * ```typescript\n * import { Lixa } from '@vunexa/lixa';\n * import { GoogleProvider } from '@vunexa/lixa-providers';\n * \n * const lixa = new Lixa({\n * providers: {\n * google: {\n * provider: new GoogleProvider(),\n * clientId: process.env.GOOGLE_CLIENT_ID!,\n * clientSecret: process.env.GOOGLE_CLIENT_SECRET!,\n * redirectUri: 'https://app.com/auth/google/callback',\n * scopes: ['openid', 'email', 'profile']\n * }\n * }\n * });\n * ```\n * \n * @example\n * Configuration with custom session and state handlers:\n * ```typescript\n * const lixa = new Lixa({\n * providers: {\n * google: {\n * provider: new GoogleProvider(),\n * clientId: process.env.GOOGLE_CLIENT_ID!,\n * clientSecret: process.env.GOOGLE_CLIENT_SECRET!,\n * redirectUri: 'https://app.com/auth/google/callback',\n * scopes: ['openid', 'email', 'profile']\n * }\n * },\n * stateHandler: {\n * storage: {\n * saveState: async (state, data, ttl) => await redis.setex(state, ttl, JSON.stringify(data)),\n * getState: async (state) => JSON.parse(await redis.get(state) || 'null'),\n * deleteState: async (state) => await redis.del(state)\n * }\n * },\n * sessionHandler: {\n * GenerateSession: async (tokenData, providerMetadata) => {\n * const { userInfo } = await extractUserInfo(tokenData, providerMetadata);\n * const user = await db.users.upsert({ email: userInfo.email });\n * return { token: tokenData.access_token, raw: { ...tokenData, userId: user.id } };\n * },\n * storage: {\n * saveSession: async (id, session, ttl) => await db.sessions.create({ id, session, ttl }),\n * getSession: async (id) => await db.sessions.findOne({ id }),\n * deleteSession: async (id) => await db.sessions.delete({ id })\n * }\n * },\n * debug: true\n * });\n * ```\n *\n/**\n * Strategy mode for multi-SSO identity account linking.\n * \n * @public\n */\nexport enum AccountLinkingStrategy {\n /** Automatically merge identities matching the same verified primary email address */\n AUTO_LINK_BY_VERIFIED_EMAIL = \"AUTO_LINK_BY_VERIFIED_EMAIL\",\n\n /** Keep identity profiles isolated per provider (no automatic account merging) */\n ISOLATED = \"ISOLATED\",\n}\n\n/**\n * Supported mode values for account linking configuration.\n * \n * @public\n */\nexport type AccountLinkingMode =\n | AccountLinkingStrategy\n | \"AUTO_LINK_BY_VERIFIED_EMAIL\"\n | \"ISOLATED\"\n | \"linkByEmail\"\n | \"separate\";\n\n/**\n * Account linking settings for Lixa.\n * \n * @public\n */\nexport interface AccountLinkingConfig {\n /**\n * Account linking mode strategy:\n * - AccountLinkingStrategy.AUTO_LINK_BY_VERIFIED_EMAIL (\"AUTO_LINK_BY_VERIFIED_EMAIL\" / \"linkByEmail\"): Auto-link accounts sharing same verified email.\n * - AccountLinkingStrategy.ISOLATED (\"ISOLATED\" / \"separate\"): Keep provider accounts isolated (default).\n * \n * @default AccountLinkingStrategy.ISOLATED\n */\n mode?: AccountLinkingMode;\n\n /**\n * Whether to require that the email address is verified by the provider before linking.\n * \n * @default true\n */\n requireVerifiedEmail?: boolean;\n}\n\n/**\n * Main configuration object for Lixa.\n * Provides type-safe provider name inference.\n * \n * @public\n */\nexport interface LixaConfig<TProviders extends Record<string, ProviderConfig> = Record<string, ProviderConfig>> {\n /** \n * Map of provider names to their configurations.\n * Provider names will be available for autocomplete in getAuthUrl() and handleCallback().\n */\n providers: TProviders;\n\n /**\n * Account linking configuration for multi-SSO user linking.\n */\n accountLinking?: AccountLinkingConfig;\n /** \n * Optional custom state handler.\n * Handles state generation and storage during OAuth authorization flow.\n * \n * - GenerateState: Customizes how state parameters and PKCE verifiers are generated\n * - storage: Provides persistent state storage (save/get/delete operations)\n * \n * Defaults to in-memory cache if not provided (not suitable for production).\n * \n * @see {@link StateHandler}\n */\n stateHandler?: StateHandler;\n \n /** \n * Optional custom session handler.\n * Handles session generation and storage after authentication.\n * \n * - GenerateSession: Customizes how OAuth tokens are converted into session data\n * - storage: Provides persistent session storage (save/get/delete operations)\n * \n * Defaults to in-memory cache if not provided (not suitable for production).\n * \n * @see {@link SessionHandler}\n */\n sessionHandler?: SessionHandler;\n\n /**\n * Optional custom resource handler.\n * Handles storage and management of long-lived third-party resource provider tokens (AuthZ)\n * bound directly to user accounts (User ID or Email), independent of transient session IDs.\n * \n * @see {@link ResourceHandler}\n */\n resourceHandler?: import(\"./dao/types\").ResourceHandler;\n \n /** \n * Enable debug logging.\n * When enabled, outputs structured logs for initialization, auth flow, and errors.\n * Format: [Lixa] [timestamp] [level] [context] message\n */\n debug?: boolean;\n\n /**\n * Optional custom structured logger implementation.\n * If provided, all Lixa logs will be routed through this logger.\n */\n logger?: LixaLogger;\n}\n\n/**\n * Log level for Lixa structured logging.\n * @public\n */\nexport type LogLevel = \"INFO\" | \"WARN\" | \"ERROR\" | \"DEBUG\";\n\n/**\n * Log context for Lixa structured logging.\n * @public\n */\nexport type LogContext = \"Init\" | \"Auth\" | \"Token\" | \"Session\" | \"State\" | \"AccountLinking\" | \"Resource\";\n\n/**\n * Custom logger interface for Lixa.\n * @public\n */\nexport interface LixaLogger {\n log(level: LogLevel, context: LogContext, message: string, data?: Record<string, unknown>): void;\n}\n\n/**\n * Helper type to create a configuration with only registered providers.\n * Use this with Lixa.createConfig() for type safety.\n * \n * @deprecated This type is maintained for backward compatibility.\n * The new inline provider configuration pattern makes this unnecessary.\n *\n * @public\n */\nexport type SafeLixaConfig<TProviders extends Record<string, ProviderConfig>> = LixaConfig<TProviders> & {\n providers: TProviders;\n};\n\n","import NodeCache from 'node-cache';\nimport { randomBytes } from 'crypto';\nimport { StateHandler, StateStorage, StateData } from \"./types\";\n\nclass LocalStateHandler implements StateHandler {\n private cache: NodeCache;\n public stateStorage: StateStorage;\n\n constructor(defaultTtlSeconds: number = 600) {\n this.cache = new NodeCache({ stdTTL: defaultTtlSeconds });\n \n // Provide storage implementation\n this.stateStorage = {\n saveState: async (state: string, data: StateData, expiresInSeconds: number): Promise<void> => {\n this.cache.set(state, data, expiresInSeconds);\n },\n\n getState: async (state: string): Promise<StateData | null> => {\n return this.cache.get<StateData>(state) || null;\n },\n\n deleteState: async (state: string): Promise<void> => {\n this.cache.del(state);\n }\n };\n }\n\n // Default generateState implementation\n async generateState(provider: string): Promise<{ state: string; data: StateData }> {\n const state = randomBytes(16).toString(\"hex\"); // 32 characters\n const codeVerifier = randomBytes(32).toString(\"hex\"); // 64 characters\n \n return {\n state,\n data: {\n provider,\n codeVerifier,\n createdAt: Date.now()\n }\n };\n }\n\n // PascalCase alias for backward compatibility\n async GenerateState(provider: string): Promise<{ state: string; data: StateData }> {\n return this.generateState(provider);\n }\n}\n\nexport { LocalStateHandler };\n\n","import NodeCache from 'node-cache';\nimport { SessionHandler, SessionStorage } from \"./types\";\nimport type { Session, OAuthTokenResponse, ProviderMetadata } from \"../models/session\";\n\nclass LocalSessionHandler implements SessionHandler {\n private cache: NodeCache;\n private emailToSessionMap: Map<string, string> = new Map();\n public sessionStorage: SessionStorage;\n\n constructor(defaultTtlSeconds: number = 600) {\n this.cache = new NodeCache({ stdTTL: defaultTtlSeconds, checkperiod: 60 });\n \n // Automatically purge email map entries when cache keys expire or are deleted to prevent memory leaks\n this.cache.on(\"expired\", (_key: string, value: any) => {\n if (value && typeof value === \"object\" && value.email) {\n this.emailToSessionMap.delete(String(value.email).toLowerCase());\n }\n });\n\n this.cache.on(\"del\", (_key: string, value: any) => {\n if (value && typeof value === \"object\" && value.email) {\n this.emailToSessionMap.delete(String(value.email).toLowerCase());\n }\n });\n\n this.cache.on(\"flush\", () => {\n this.emailToSessionMap.clear();\n });\n\n // Provide storage implementation\n this.sessionStorage = {\n saveSession: async <T extends Session>(sessionId: string, session: T, expiresInSeconds: number): Promise<void> => {\n this.cache.set(sessionId, session, expiresInSeconds);\n if (session.email) {\n this.emailToSessionMap.set(session.email.toLowerCase(), sessionId);\n }\n },\n\n getSession: async <T extends Session>(sessionId: string): Promise<T | null> => {\n return this.cache.get<T>(sessionId) || null;\n },\n\n deleteSession: async (sessionId: string): Promise<void> => {\n const session = this.cache.get<Session>(sessionId);\n if (session?.email) {\n this.emailToSessionMap.delete(session.email.toLowerCase());\n }\n this.cache.del(sessionId);\n },\n\n getSessionByEmail: async <T extends Session>(email: string): Promise<{ sessionId: string; session: T } | null> => {\n const normalizedEmail = email.toLowerCase();\n const sessionId = this.emailToSessionMap.get(normalizedEmail);\n if (!sessionId) return null;\n const session = this.cache.get<T>(sessionId);\n if (!session) {\n this.emailToSessionMap.delete(normalizedEmail);\n return null;\n }\n return { sessionId, session };\n }\n };\n }\n\n // Default generateSession implementation\n async generateSession<T extends Session>(\n tokenData: OAuthTokenResponse,\n _providerMetadata?: ProviderMetadata\n ): Promise<T> {\n if (!tokenData.access_token || typeof tokenData.access_token !== 'string') {\n throw new Error('No valid access token found in OAuth response');\n }\n\n const session: Session = {\n token: tokenData.access_token,\n raw: tokenData,\n };\n\n return session as T;\n }\n\n // PascalCase alias for backward compatibility\n async GenerateSession<T extends Session>(\n tokenData: OAuthTokenResponse,\n providerMetadata?: ProviderMetadata\n ): Promise<T> {\n return this.generateSession(tokenData, providerMetadata);\n }\n}\n\nexport { LocalSessionHandler };\n\n","import type { OAuthTokenResponse, ProviderMetadata } from \"../models/session\";\n\n/**\n * User information extracted from OAuth provider\n * \n * @public\n */\nexport interface UserInfo {\n email: string;\n id?: string | undefined;\n sub?: string | undefined;\n given_name?: string | undefined;\n family_name?: string | undefined;\n name?: string | undefined;\n picture?: string | undefined;\n email_verified?: boolean | undefined;\n iss?: string | undefined;\n}\n\n/**\n * Decode JWT ID token to extract user information\n * \n * @public\n */\nexport function decodeIdToken(idToken: string): UserInfo {\n const parts = idToken.split('.');\n if (parts.length !== 3) {\n throw new Error('Invalid ID token format: expected 3 parts separated by dots');\n }\n \n const base64Payload = parts[1];\n if (!base64Payload) {\n throw new Error('Invalid ID token: missing payload section');\n }\n const payload = Buffer.from(base64Payload, 'base64').toString();\n \n try {\n return JSON.parse(payload);\n } catch (error) {\n throw new Error('Invalid ID token: failed to parse payload JSON');\n }\n}\n\n/**\n * Determine OAuth provider from ID token issuer\n * \n * @public\n */\nexport function determineProviderFromIssuer(userInfo: UserInfo): string | null {\n if (!userInfo.iss) {\n return null;\n }\n \n const issuer = userInfo.iss.toLowerCase();\n \n if (issuer.includes('accounts.google.com')) {\n return 'google';\n }\n \n if (issuer.includes('github')) {\n return 'github';\n }\n \n // Unknown issuer\n return null;\n}\n\n/**\n * Fetch user info from OAuth provider's userinfo endpoint\n * \n * @param accessToken - OAuth access token\n * @param userInfoEndpoint - The provider's userinfo endpoint URL\n * @param providerName - Provider name for error messages (optional)\n * @returns User information from the provider\n * \n * @throws Error if the request fails or response is invalid\n * \n * @public\n */\nexport async function fetchUserInfo(\n accessToken: string, \n userInfoEndpoint: string\n): Promise<UserInfo> {\n const response = await fetch(userInfoEndpoint, {\n headers: {\n Authorization: `Bearer ${accessToken}`,\n Accept: 'application/json',\n },\n });\n \n if (!response.ok) {\n throw new Error(`Failed to fetch user info: ${response.status} ${response.statusText}`);\n }\n \n const data = await response.json();\n if (!data || typeof data !== 'object' || !('email' in data) || typeof data.email !== 'string') {\n throw new Error(`Invalid user info response: missing or invalid email`);\n }\n \n return {\n email: data.email,\n id: 'id' in data ? String(data.id) : undefined,\n sub: 'sub' in data ? String(data.sub) : undefined,\n given_name: 'given_name' in data ? String(data.given_name) : undefined,\n family_name: 'family_name' in data ? String(data.family_name) : undefined,\n name: 'name' in data ? String(data.name) : undefined,\n picture: 'picture' in data ? String(data.picture) : undefined,\n email_verified: 'email_verified' in data ? Boolean(data.email_verified) : undefined,\n iss: 'iss' in data ? String(data.iss) : undefined,\n };\n}\n\n/**\n * Extract user info from OAuth token data\n * \n * @param tokenData - OAuth token response from provider\n * @param providerMetadata - Provider metadata containing endpoints configuration\n * @returns User info extracted from token or fetched from provider\n * \n * @remarks\n * This function attempts to extract user information in the following order:\n * 1. Decode ID token if present (preferred method for OIDC providers)\n * 2. Fetch from userinfo endpoint using access token (uses providerMetadata.endpoints.userInfo)\n * \n * The function automatically determines the best method based on available token data.\n * For OIDC providers (like Google), it decodes the JWT ID token.\n * For OAuth-only providers (like GitHub), it fetches from the userinfo endpoint.\n * \n * @throws Error if no ID token or access token is available\n * @throws Error if userinfo endpoint is required but not provided in providerMetadata\n * \n * @example\n * With ID token (OIDC provider like Google):\n * ```typescript\n * const { userInfo } = await extractUserInfo(tokenData, providerMetadata);\n * console.log(`User ${userInfo.email} authenticated`);\n * ```\n * \n * @example\n * Without ID token (OAuth provider like GitHub):\n * ```typescript\n * const { userInfo } = await extractUserInfo(tokenData, providerMetadata);\n * // Automatically fetches from providerMetadata.endpoints.userInfo\n * console.log(`User ${userInfo.email} authenticated`);\n * ```\n * \n * @public\n */\nexport async function extractUserInfo(\n tokenData: OAuthTokenResponse,\n providerMetadata: ProviderMetadata\n): Promise<{ userInfo: UserInfo }> {\n let userInfo: UserInfo;\n const userInfoEndpoint = providerMetadata.endpoints.userInfo;\n \n if (tokenData.id_token) {\n // Decode ID token to get user info\n userInfo = decodeIdToken(tokenData.id_token);\n } else if (tokenData.access_token) {\n // Fetch user info from provider's API\n userInfo = await fetchUserInfo(tokenData.access_token, userInfoEndpoint);\n } else {\n throw new Error('No ID token or access token available to fetch user info');\n }\n \n return { userInfo };\n}\n","/**\n * Base error class for all Lixa authentication and authorization errors.\n * \n * @public\n */\nexport class LixaError extends Error {\n /**\n * Standard error code string.\n */\n public readonly code: string;\n\n /**\n * Additional error context data.\n */\n public readonly details: Record<string, unknown> | undefined;\n\n constructor(message: string, code: string = \"LIXA_ERROR\", details?: Record<string, unknown>) {\n super(message);\n this.name = this.constructor.name;\n this.code = code;\n this.details = details;\n\n // Maintain proper prototype chain\n Object.setPrototypeOf(this, new.target.prototype);\n }\n}\n\n/**\n * Thrown when an OAuth state parameter is invalid, missing, or has expired.\n * \n * @public\n */\nexport class InvalidStateError extends LixaError {\n constructor(message: string = \"Invalid or expired state\", details?: Record<string, unknown>) {\n super(message, \"INVALID_STATE\", details);\n }\n}\n\n/**\n * Thrown when attempting to use a provider that is not configured in the Lixa instance.\n * \n * @public\n */\nexport class ProviderNotConfiguredError extends LixaError {\n constructor(provider: string, details?: Record<string, unknown>) {\n const message = details?.message && typeof details.message === \"string\"\n ? details.message\n : `Provider '${provider}' is not available. Either import it from '@vunexa/lixa-providers' and include it in the configuration, or provide a custom implementation using the 'provider' field: { provider: new CustomProvider(), clientId: '...', ... }`;\n super(message, \"PROVIDER_NOT_CONFIGURED\", {\n provider,\n ...details,\n });\n }\n}\n\n/**\n * Thrown when a provider configuration is invalid or missing required credentials.\n * \n * @public\n */\nexport class InvalidProviderConfigError extends LixaError {\n constructor(message: string, details?: Record<string, unknown>) {\n super(message, \"INVALID_PROVIDER_CONFIG\", details);\n }\n}\n\n/**\n * Thrown when OAuth callback parameters (e.g. authorization code or state) are missing or malformed.\n * \n * @public\n */\nexport class InvalidOAuthCallbackError extends LixaError {\n constructor(message: string, details?: Record<string, unknown>) {\n super(message, \"INVALID_OAUTH_CALLBACK\", details);\n }\n}\n\n/**\n * Thrown when exchanging an authorization code for OAuth tokens fails at the provider endpoint.\n * \n * @public\n */\nexport class TokenExchangeError extends LixaError {\n public readonly status: number | undefined;\n\n constructor(message: string, status?: number, details?: Record<string, unknown>) {\n super(message, \"TOKEN_EXCHANGE_FAILED\", { status, ...details });\n this.status = status;\n }\n}\n\n/**\n * Thrown when a user session is not found or has expired.\n * \n * @public\n */\nexport class SessionNotFoundError extends LixaError {\n constructor(message: string = \"Active session not found or has expired\", details?: Record<string, unknown>) {\n super(message, \"SESSION_NOT_FOUND\", details);\n }\n}\n\n/**\n * Thrown when account linking fails, e.g. when unverified email linking is rejected.\n * \n * @public\n */\nexport class EmailNotVerifiedError extends LixaError {\n constructor(email?: string, details?: Record<string, unknown>) {\n super(\n `Cannot link account: email '${email || \"unknown\"}' is not verified by the identity provider`,\n \"EMAIL_NOT_VERIFIED\",\n { email, ...details }\n );\n }\n}\n\n/**\n * Thrown when unlinking an account violates security constraints (e.g. unlinking the only login provider).\n * \n * @public\n */\nexport class AccountUnlinkError extends LixaError {\n constructor(message: string, details?: Record<string, unknown>) {\n super(message, \"ACCOUNT_UNLINK_ERROR\", details);\n }\n}\n\n/**\n * Thrown when a refresh token is missing or token refresh fails for a connected resource.\n * \n * @public\n */\nexport class RefreshTokenError extends LixaError {\n constructor(message: string, details?: Record<string, unknown>) {\n super(message, \"REFRESH_TOKEN_ERROR\", details);\n }\n}\n","/**\n * Sensible default cookie configuration options.\n * Follows RFC 6265bis and OAuth 2.0 security best practices.\n * \n * @public\n */\nexport interface CookieOptions {\n /**\n * Cookie name.\n * @default 'lixa_session'\n */\n name?: string | undefined;\n\n /**\n * Cookie path.\n * @default '/'\n */\n path?: string | undefined;\n\n /**\n * Maximum age of the cookie in seconds.\n */\n maxAge?: number | undefined;\n\n /**\n * Prevents client-side scripts from accessing the cookie (XSS protection).\n * @default true\n */\n httpOnly?: boolean | undefined;\n\n /**\n * Ensures the cookie is only transmitted over secure HTTPS connections.\n * @default false in development, true in production\n */\n secure?: boolean | undefined;\n\n /**\n * Controls whether the cookie is sent with cross-site requests (CSRF protection).\n * @default 'lax'\n */\n sameSite?: \"lax\" | \"strict\" | \"none\" | undefined;\n\n /**\n * Cookie domain.\n */\n domain?: string | undefined;\n}\n\n/**\n * Cookie payload containing name, value, options, and formatted header.\n * \n * @public\n */\nexport interface CookiePayload {\n name: string;\n value: string;\n options: CookieOptions;\n /**\n * Formatted `Set-Cookie` header value string.\n */\n header: string;\n}\n\n/**\n * Default session cookie name.\n * @public\n */\nexport const DEFAULT_SESSION_COOKIE_NAME = \"lixa_session\";\n\n/**\n * Default OAuth state cookie name.\n * @public\n */\nexport const DEFAULT_STATE_COOKIE_NAME = \"lixa_oauth_state\";\n\n/**\n * Default session max age in seconds (24 hours).\n * @public\n */\nexport const DEFAULT_SESSION_MAX_AGE_SECONDS = 24 * 60 * 60; // 24 hours\n\n/**\n * Default OAuth state max age in seconds (5 minutes / 300 seconds).\n * @public\n */\nexport const DEFAULT_STATE_MAX_AGE_SECONDS = 5 * 60; // 5 minutes (synchronized with state storage TTL)\n\n/**\n * Checks if the runtime environment is production.\n * @public\n */\nexport function isProductionEnvironment(): boolean {\n return typeof process !== \"undefined\" && process.env?.NODE_ENV === \"production\";\n}\n\n/**\n * Serializes a cookie name, value, and options into a standard `Set-Cookie` header string.\n * \n * @param name - Cookie name\n * @param value - Cookie value\n * @param options - Cookie attributes\n * @returns Formatted `Set-Cookie` string\n * \n * @public\n */\nexport function serializeCookie(name: string, value: string, options?: CookieOptions): string {\n const isProd = isProductionEnvironment();\n const path = options?.path ?? \"/\";\n const httpOnly = options?.httpOnly ?? true;\n const secure = options?.secure ?? isProd;\n const sameSite = options?.sameSite ?? \"lax\";\n\n const parts: string[] = [`${encodeURIComponent(name)}=${encodeURIComponent(value)}`];\n\n if (path) {\n parts.push(`Path=${path}`);\n }\n\n if (typeof options?.maxAge === \"number\") {\n parts.push(`Max-Age=${Math.floor(options.maxAge)}`);\n // Also include Expires for legacy browser compatibility\n const expires = new Date(Date.now() + options.maxAge * 1000).toUTCString();\n parts.push(`Expires=${expires}`);\n }\n\n if (options?.domain) {\n parts.push(`Domain=${options.domain}`);\n }\n\n if (httpOnly) {\n parts.push(\"HttpOnly\");\n }\n\n if (secure) {\n parts.push(\"Secure\");\n }\n\n if (sameSite) {\n const capitalized = sameSite.charAt(0).toUpperCase() + sameSite.slice(1).toLowerCase();\n parts.push(`SameSite=${capitalized}`);\n }\n\n return parts.join(\"; \");\n}\n\n/**\n * Generates a session cookie payload with secure default options.\n * \n * @param sessionId - The session identifier string\n * @param options - Optional overrides for cookie attributes\n * \n * @example\n * ```typescript\n * const cookie = createSessionCookie(sessionId);\n * res.setHeader(\"Set-Cookie\", cookie.header);\n * // or with Express:\n * res.cookie(cookie.name, cookie.value, cookie.options);\n * ```\n * \n * @public\n */\nexport function createSessionCookie(sessionId: string, options?: CookieOptions): CookiePayload {\n const isProd = isProductionEnvironment();\n const resolvedOptions: CookieOptions = {\n name: options?.name || DEFAULT_SESSION_COOKIE_NAME,\n path: options?.path ?? \"/\",\n maxAge: options?.maxAge ?? DEFAULT_SESSION_MAX_AGE_SECONDS,\n httpOnly: options?.httpOnly ?? true,\n secure: options?.secure ?? isProd,\n sameSite: options?.sameSite ?? \"lax\",\n domain: options?.domain,\n };\n\n const name = resolvedOptions.name!;\n const header = serializeCookie(name, sessionId, resolvedOptions);\n\n return {\n name,\n value: sessionId,\n options: resolvedOptions,\n header,\n };\n}\n\n/**\n * Generates an expired session cookie payload to clear the session on logout.\n * \n * @param options - Optional overrides for cookie name or attributes\n * \n * @example\n * ```typescript\n * const cookie = clearSessionCookie();\n * res.setHeader(\"Set-Cookie\", cookie.header);\n * // or with Express:\n * res.clearCookie(cookie.name, cookie.options);\n * ```\n * \n * @public\n */\nexport function clearSessionCookie(options?: CookieOptions): CookiePayload {\n const isProd = isProductionEnvironment();\n const resolvedOptions: CookieOptions = {\n name: options?.name || DEFAULT_SESSION_COOKIE_NAME,\n path: options?.path ?? \"/\",\n maxAge: 0,\n httpOnly: options?.httpOnly ?? true,\n secure: options?.secure ?? isProd,\n sameSite: options?.sameSite ?? \"lax\",\n domain: options?.domain,\n };\n\n const name = resolvedOptions.name!;\n const header = serializeCookie(name, \"\", resolvedOptions);\n\n return {\n name,\n value: \"\",\n options: resolvedOptions,\n header,\n };\n}\n\n/**\n * Generates an OAuth CSRF state cookie payload for in-flight authorization flows.\n * \n * @param state - The random state string\n * @param options - Optional overrides for cookie attributes\n * \n * @public\n */\nexport function createStateCookie(state: string, options?: CookieOptions): CookiePayload {\n const isProd = isProductionEnvironment();\n const resolvedOptions: CookieOptions = {\n name: options?.name || DEFAULT_STATE_COOKIE_NAME,\n path: options?.path ?? \"/\",\n maxAge: options?.maxAge ?? DEFAULT_STATE_MAX_AGE_SECONDS,\n httpOnly: options?.httpOnly ?? true,\n secure: options?.secure ?? isProd,\n sameSite: options?.sameSite ?? \"lax\",\n domain: options?.domain,\n };\n\n const name = resolvedOptions.name!;\n const header = serializeCookie(name, state, resolvedOptions);\n\n return {\n name,\n value: state,\n options: resolvedOptions,\n header,\n };\n}\n\n/**\n * Generates an expired OAuth state cookie payload to clean up the state cookie after callback.\n * \n * @param options - Optional overrides for cookie attributes\n * \n * @public\n */\nexport function clearStateCookie(options?: CookieOptions): CookiePayload {\n const isProd = isProductionEnvironment();\n const resolvedOptions: CookieOptions = {\n name: options?.name || DEFAULT_STATE_COOKIE_NAME,\n path: options?.path ?? \"/\",\n maxAge: 0,\n httpOnly: options?.httpOnly ?? true,\n secure: options?.secure ?? isProd,\n sameSite: options?.sameSite ?? \"lax\",\n domain: options?.domain,\n };\n\n const name = resolvedOptions.name!;\n const header = serializeCookie(name, \"\", resolvedOptions);\n\n return {\n name,\n value: \"\",\n options: resolvedOptions,\n header,\n };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,IAAAA,iBAA4B;;;ACuJrB,IAAK,yBAAL,kBAAKC,4BAAL;AAEL,EAAAA,wBAAA,iCAA8B;AAG9B,EAAAA,wBAAA,cAAW;AALD,SAAAA;AAAA,GAAA;;;ACvJZ,wBAAsB;AACtB,oBAA4B;AAG5B,IAAM,oBAAN,MAAgD;AAAA,EACtC;AAAA,EACD;AAAA,EAEP,YAAY,oBAA4B,KAAK;AAC3C,SAAK,QAAQ,IAAI,kBAAAC,QAAU,EAAE,QAAQ,kBAAkB,CAAC;AAGxD,SAAK,eAAe;AAAA,MAClB,WAAW,OAAO,OAAe,MAAiB,qBAA4C;AAC5F,aAAK,MAAM,IAAI,OAAO,MAAM,gBAAgB;AAAA,MAC9C;AAAA,MAEA,UAAU,OAAO,UAA6C;AAC5D,eAAO,KAAK,MAAM,IAAe,KAAK,KAAK;AAAA,MAC7C;AAAA,MAEA,aAAa,OAAO,UAAiC;AACnD,aAAK,MAAM,IAAI,KAAK;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,cAAc,UAA+D;AACjF,UAAM,YAAQ,2BAAY,EAAE,EAAE,SAAS,KAAK;AAC5C,UAAM,mBAAe,2BAAY,EAAE,EAAE,SAAS,KAAK;AAEnD,WAAO;AAAA,MACL;AAAA,MACA,MAAM;AAAA,QACJ;AAAA,QACA;AAAA,QACA,WAAW,KAAK,IAAI;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,cAAc,UAA+D;AACjF,WAAO,KAAK,cAAc,QAAQ;AAAA,EACpC;AACF;;;AFzCA,IAAAC,iBAAmB;;;AGLnB,IAAAC,qBAAsB;AAItB,IAAM,sBAAN,MAAoD;AAAA,EAC1C;AAAA,EACA,oBAAyC,oBAAI,IAAI;AAAA,EAClD;AAAA,EAEP,YAAY,oBAA4B,KAAK;AAC3C,SAAK,QAAQ,IAAI,mBAAAC,QAAU,EAAE,QAAQ,mBAAmB,aAAa,GAAG,CAAC;AAGzE,SAAK,MAAM,GAAG,WAAW,CAAC,MAAc,UAAe;AACrD,UAAI,SAAS,OAAO,UAAU,YAAY,MAAM,OAAO;AACrD,aAAK,kBAAkB,OAAO,OAAO,MAAM,KAAK,EAAE,YAAY,CAAC;AAAA,MACjE;AAAA,IACF,CAAC;AAED,SAAK,MAAM,GAAG,OAAO,CAAC,MAAc,UAAe;AACjD,UAAI,SAAS,OAAO,UAAU,YAAY,MAAM,OAAO;AACrD,aAAK,kBAAkB,OAAO,OAAO,MAAM,KAAK,EAAE,YAAY,CAAC;AAAA,MACjE;AAAA,IACF,CAAC;AAED,SAAK,MAAM,GAAG,SAAS,MAAM;AAC3B,WAAK,kBAAkB,MAAM;AAAA,IAC/B,CAAC;AAGD,SAAK,iBAAiB;AAAA,MACpB,aAAa,OAA0B,WAAmB,SAAY,qBAA4C;AAChH,aAAK,MAAM,IAAI,WAAW,SAAS,gBAAgB;AACnD,YAAI,QAAQ,OAAO;AACjB,eAAK,kBAAkB,IAAI,QAAQ,MAAM,YAAY,GAAG,SAAS;AAAA,QACnE;AAAA,MACF;AAAA,MAEA,YAAY,OAA0B,cAAyC;AAC7E,eAAO,KAAK,MAAM,IAAO,SAAS,KAAK;AAAA,MACzC;AAAA,MAEA,eAAe,OAAO,cAAqC;AACzD,cAAM,UAAU,KAAK,MAAM,IAAa,SAAS;AACjD,YAAI,SAAS,OAAO;AAClB,eAAK,kBAAkB,OAAO,QAAQ,MAAM,YAAY,CAAC;AAAA,QAC3D;AACA,aAAK,MAAM,IAAI,SAAS;AAAA,MAC1B;AAAA,MAEA,mBAAmB,OAA0B,UAAqE;AAChH,cAAM,kBAAkB,MAAM,YAAY;AAC1C,cAAM,YAAY,KAAK,kBAAkB,IAAI,eAAe;AAC5D,YAAI,CAAC,UAAW,QAAO;AACvB,cAAM,UAAU,KAAK,MAAM,IAAO,SAAS;AAC3C,YAAI,CAAC,SAAS;AACZ,eAAK,kBAAkB,OAAO,eAAe;AAC7C,iBAAO;AAAA,QACT;AACA,eAAO,EAAE,WAAW,QAAQ;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,gBACJ,WACA,mBACY;AACZ,QAAI,CAAC,UAAU,gBAAgB,OAAO,UAAU,iBAAiB,UAAU;AACzE,YAAM,IAAI,MAAM,+CAA+C;AAAA,IACjE;AAEA,UAAM,UAAmB;AAAA,MACvB,OAAO,UAAU;AAAA,MACjB,KAAK;AAAA,IACP;AAEA,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,gBACJ,WACA,kBACY;AACZ,WAAO,KAAK,gBAAgB,WAAW,gBAAgB;AAAA,EACzD;AACF;;;AChEO,SAAS,cAAc,SAA2B;AACvD,QAAM,QAAQ,QAAQ,MAAM,GAAG;AAC/B,MAAI,MAAM,WAAW,GAAG;AACtB,UAAM,IAAI,MAAM,6DAA6D;AAAA,EAC/E;AAEA,QAAM,gBAAgB,MAAM,CAAC;AAC7B,MAAI,CAAC,eAAe;AAClB,UAAM,IAAI,MAAM,2CAA2C;AAAA,EAC7D;AACA,QAAM,UAAU,OAAO,KAAK,eAAe,QAAQ,EAAE,SAAS;AAE9D,MAAI;AACF,WAAO,KAAK,MAAM,OAAO;AAAA,EAC3B,SAAS,OAAO;AACd,UAAM,IAAI,MAAM,gDAAgD;AAAA,EAClE;AACF;AAOO,SAAS,4BAA4B,UAAmC;AAC7E,MAAI,CAAC,SAAS,KAAK;AACjB,WAAO;AAAA,EACT;AAEA,QAAM,SAAS,SAAS,IAAI,YAAY;AAExC,MAAI,OAAO,SAAS,qBAAqB,GAAG;AAC1C,WAAO;AAAA,EACT;AAEA,MAAI,OAAO,SAAS,QAAQ,GAAG;AAC7B,WAAO;AAAA,EACT;AAGA,SAAO;AACT;AAcA,eAAsB,cACpB,aACA,kBACmB;AACnB,QAAM,WAAW,MAAM,MAAM,kBAAkB;AAAA,IAC7C,SAAS;AAAA,MACP,eAAe,UAAU,WAAW;AAAA,MACpC,QAAQ;AAAA,IACV;AAAA,EACF,CAAC;AAED,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,MAAM,8BAA8B,SAAS,MAAM,IAAI,SAAS,UAAU,EAAE;AAAA,EACxF;AAEA,QAAM,OAAO,MAAM,SAAS,KAAK;AACjC,MAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,EAAE,WAAW,SAAS,OAAO,KAAK,UAAU,UAAU;AAC7F,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AAEA,SAAO;AAAA,IACL,OAAO,KAAK;AAAA,IACZ,IAAI,QAAQ,OAAO,OAAO,KAAK,EAAE,IAAI;AAAA,IACrC,KAAK,SAAS,OAAO,OAAO,KAAK,GAAG,IAAI;AAAA,IACxC,YAAY,gBAAgB,OAAO,OAAO,KAAK,UAAU,IAAI;AAAA,IAC7D,aAAa,iBAAiB,OAAO,OAAO,KAAK,WAAW,IAAI;AAAA,IAChE,MAAM,UAAU,OAAO,OAAO,KAAK,IAAI,IAAI;AAAA,IAC3C,SAAS,aAAa,OAAO,OAAO,KAAK,OAAO,IAAI;AAAA,IACpD,gBAAgB,oBAAoB,OAAO,QAAQ,KAAK,cAAc,IAAI;AAAA,IAC1E,KAAK,SAAS,OAAO,OAAO,KAAK,GAAG,IAAI;AAAA,EAC1C;AACF;AAsCA,eAAsB,gBACpB,WACA,kBACiC;AACjC,MAAI;AACJ,QAAM,mBAAmB,iBAAiB,UAAU;AAEpD,MAAI,UAAU,UAAU;AAEtB,eAAW,cAAc,UAAU,QAAQ;AAAA,EAC7C,WAAW,UAAU,cAAc;AAEjC,eAAW,MAAM,cAAc,UAAU,cAAc,gBAAgB;AAAA,EACzE,OAAO;AACL,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AAEA,SAAO,EAAE,SAAS;AACpB;;;ACjKO,IAAM,YAAN,cAAwB,MAAM;AAAA;AAAA;AAAA;AAAA,EAInB;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA,EAEhB,YAAY,SAAiB,OAAe,cAAc,SAAmC;AAC3F,UAAM,OAAO;AACb,SAAK,OAAO,KAAK,YAAY;AAC7B,SAAK,OAAO;AACZ,SAAK,UAAU;AAGf,WAAO,eAAe,MAAM,WAAW,SAAS;AAAA,EAClD;AACF;AAOO,IAAM,oBAAN,cAAgC,UAAU;AAAA,EAC/C,YAAY,UAAkB,4BAA4B,SAAmC;AAC3F,UAAM,SAAS,iBAAiB,OAAO;AAAA,EACzC;AACF;AAOO,IAAM,6BAAN,cAAyC,UAAU;AAAA,EACxD,YAAY,UAAkB,SAAmC;AAC/D,UAAM,UAAU,SAAS,WAAW,OAAO,QAAQ,YAAY,WAC3D,QAAQ,UACR,aAAa,QAAQ;AACzB,UAAM,SAAS,2BAA2B;AAAA,MACxC;AAAA,MACA,GAAG;AAAA,IACL,CAAC;AAAA,EACH;AACF;AAOO,IAAM,6BAAN,cAAyC,UAAU;AAAA,EACxD,YAAY,SAAiB,SAAmC;AAC9D,UAAM,SAAS,2BAA2B,OAAO;AAAA,EACnD;AACF;AAOO,IAAM,4BAAN,cAAwC,UAAU;AAAA,EACvD,YAAY,SAAiB,SAAmC;AAC9D,UAAM,SAAS,0BAA0B,OAAO;AAAA,EAClD;AACF;AAOO,IAAM,qBAAN,cAAiC,UAAU;AAAA,EAChC;AAAA,EAEhB,YAAY,SAAiB,QAAiB,SAAmC;AAC/E,UAAM,SAAS,yBAAyB,EAAE,QAAQ,GAAG,QAAQ,CAAC;AAC9D,SAAK,SAAS;AAAA,EAChB;AACF;AAOO,IAAM,uBAAN,cAAmC,UAAU;AAAA,EAClD,YAAY,UAAkB,2CAA2C,SAAmC;AAC1G,UAAM,SAAS,qBAAqB,OAAO;AAAA,EAC7C;AACF;AAOO,IAAM,wBAAN,cAAoC,UAAU;AAAA,EACnD,YAAY,OAAgB,SAAmC;AAC7D;AAAA,MACE,+BAA+B,SAAS,SAAS;AAAA,MACjD;AAAA,MACA,EAAE,OAAO,GAAG,QAAQ;AAAA,IACtB;AAAA,EACF;AACF;AAOO,IAAM,qBAAN,cAAiC,UAAU;AAAA,EAChD,YAAY,SAAiB,SAAmC;AAC9D,UAAM,SAAS,wBAAwB,OAAO;AAAA,EAChD;AACF;AAOO,IAAM,oBAAN,cAAgC,UAAU;AAAA,EAC/C,YAAY,SAAiB,SAAmC;AAC9D,UAAM,SAAS,uBAAuB,OAAO;AAAA,EAC/C;AACF;;;AL1DA,IAAM,OAAN,MAAM,MAA8E;AAAA,EAClF,OAAe,oBAA4C,oBAAI,IAAI;AAAA,EACnE,OAAe,uBAA+C,oBAAI,IAAI;AAAA;AAAA;AAAA,EAG9D;AAAA,EACA;AAAA,EACA;AAAA,EACA,oBAAiE,oBAAI,IAAI;AAAA,EACzE,iBAA0D,oBAAI,IAAI;AAAA,EAElE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeR,YAAY,QAAiB;AAC3B,SAAK,SAAS;AACd,SAAK,QAAQ,OAAO,SAAS;AAG7B,SAAK,oBAAoB,IAAI,kBAAkB;AAC/C,SAAK,sBAAsB,IAAI,oBAAoB;AACnD,SAAK,uBAAuB;AAAA,MAC1B,iBAAiB;AAAA,QACf,cAAc,OAAO,QAAgB,UAAkB,aAAgC;AACrF,cAAI,UAAU,KAAK,kBAAkB,IAAI,MAAM;AAC/C,cAAI,CAAC,SAAS;AACZ,sBAAU,oBAAI,IAAI;AAClB,iBAAK,kBAAkB,IAAI,QAAQ,OAAO;AAAA,UAC5C;AACA,kBAAQ,IAAI,SAAS,YAAY,GAAG,QAAQ;AAAA,QAC9C;AAAA,QACA,aAAa,OAAO,QAAgB,aAAqB;AACvD,gBAAM,UAAU,KAAK,kBAAkB,IAAI,MAAM;AACjD,iBAAO,SAAS,IAAI,SAAS,YAAY,CAAC,KAAK;AAAA,QACjD;AAAA,QACA,kBAAkB,OAAO,WAAmB;AAC1C,gBAAM,UAAU,KAAK,kBAAkB,IAAI,MAAM;AACjD,gBAAM,SAA4C,CAAC;AACnD,cAAI,SAAS;AACX,uBAAW,CAAC,GAAG,CAAC,KAAK,QAAQ,QAAQ,GAAG;AACtC,qBAAO,CAAC,IAAI;AAAA,YACd;AAAA,UACF;AACA,iBAAO;AAAA,QACT;AAAA,QACA,gBAAgB,OAAO,QAAgB,aAAqB;AAC1D,gBAAM,UAAU,KAAK,kBAAkB,IAAI,MAAM;AACjD,cAAI,SAAS;AACX,oBAAQ,OAAO,SAAS,YAAY,CAAC;AAAA,UACvC;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,SAAK,eAAe,OAAO,gBAAgB,KAAK;AAChD,SAAK,iBAAiB,OAAO,kBAAkB,KAAK;AACpD,SAAK,kBAAkB,OAAO,mBAAmB,KAAK;AAEtD,SAAK,IAAI,QAAQ,QAAQ,8BAA8B;AAAA,MACrD,WAAW,OAAO,KAAK,OAAO,SAAS;AAAA,MACvC,OAAO,KAAK;AAAA,IACd,CAAC;AAGD,eAAW,CAAC,cAAc,cAAc,KAAK,OAAO,QAAQ,OAAO,SAAS,GAAG;AAC7E,YAAM,OAAO,aAAa,YAAY;AACtC,YAAM,cAA8B;AAGpC,WAAK,uBAAuB,cAAc,WAAW;AAGrD,UAAI,YAAY,UAAU;AACxB,aAAK,+BAA+B,cAAc,YAAY,QAAQ;AACtE,aAAK,IAAI,QAAQ,QAAQ,+BAA+B,YAAY,EAAE;AAAA,MACxE,OAAO;AAEL,YAAI,CAAC,MAAK,kBAAkB,IAAI,IAAI,KAAK,CAAC,MAAK,qBAAqB,IAAI,IAAI,GAAG;AAC7E,eAAK,IAAI,SAAS,QAAQ,aAAa,YAAY,iBAAiB;AACpE,gBAAM,IAAI;AAAA,YACR;AAAA,YACA,EAAE,MAAM,qFAAqF;AAAA,UAC/F;AAAA,QACF;AACA,aAAK,IAAI,QAAQ,QAAQ,8BAA8B,YAAY,EAAE;AAAA,MACvE;AAAA,IACF;AAEA,SAAK,IAAI,QAAQ,QAAQ,wCAAwC;AAAA,EACnE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,uBAAuB,MAAc,QAA8B;AACzE,UAAM,iBAA2C,CAAC,YAAY,gBAAgB,eAAe,QAAQ;AACrG,UAAM,gBAAgB,eAAe,OAAO,WAAS;AACnD,YAAM,QAAQ,OAAO,KAAK;AAC1B,aAAO,UAAU,UAAa,UAAU,QAAS,OAAO,UAAU,YAAY,MAAM,KAAK,MAAM;AAAA,IACjG,CAAC;AAED,QAAI,cAAc,SAAS,GAAG;AAC5B,YAAM,IAAI;AAAA,QACR,aAAa,IAAI,+CAA+C,cAAc,KAAK,IAAI,CAAC;AAAA,QACxF,EAAE,UAAU,MAAM,cAAc;AAAA,MAClC;AAAA,IACF;AAGA,QAAI,CAAC,MAAM,QAAQ,OAAO,MAAM,GAAG;AACjC,YAAM,IAAI;AAAA,QACR,aAAa,IAAI;AAAA,QACjB,EAAE,UAAU,KAAK;AAAA,MACnB;AAAA,IACF;AAEA,QAAI,OAAO,OAAO,WAAW,GAAG;AAC9B,YAAM,IAAI;AAAA,QACR,aAAa,IAAI;AAAA,QACjB,EAAE,UAAU,KAAK;AAAA,MACnB;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,+BAA+B,MAAc,UAA2B;AAC9E,UAAM,gBAAqC,CAAC,yBAAyB,iBAAiB,kBAAkB;AACxG,UAAM,eAAe,cAAc,OAAO,UAAQ;AAChD,YAAM,QAAQ,SAAS,IAAI;AAC3B,aAAO,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,KAAK,MAAM;AAAA,IACjE,CAAC;AAED,QAAI,aAAa,SAAS,GAAG;AAC3B,YAAM,IAAI;AAAA,QACR,aAAa,IAAI,oDAAoD,aAAa,KAAK,IAAI,CAAC;AAAA,QAE5F,EAAE,UAAU,MAAM,aAAa;AAAA,MACjC;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUQ,IACN,OACA,SACA,SACA,MACM;AACN,QAAI,KAAK,OAAO,QAAQ;AACtB,UAAI;AACF,aAAK,OAAO,OAAO,IAAI,OAAO,SAAS,SAAS,IAAI;AAAA,MACtD,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,QAAI,CAAC,KAAK,MAAO;AAEjB,UAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AACzC,UAAM,SAAS,WAAW,SAAS,MAAM,KAAK,MAAM,OAAO;AAE3D,QAAI,SAAS,QAAW;AACtB,cAAQ,IAAI,GAAG,MAAM,IAAI,OAAO,IAAI,IAAI;AAAA,IAC1C,OAAO;AACL,cAAQ,IAAI,GAAG,MAAM,IAAI,OAAO,EAAE;AAAA,IACpC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBO,qBAAuC,UAA6D;AACzG,UAAM,eAAe,SAAS,YAAY;AAC1C,WAAO,KAAK,OAAO,UAAU,eAAe,YAAY;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWQ,YAAY,MAAc,QAAmC;AAEnE,QAAI,OAAO,UAAU;AACnB,aAAO,OAAO;AAAA,IAChB;AAGA,UAAM,YAAY,KAAK,YAAY;AACnC,UAAM,kBAAkB,MAAK,kBAAkB,IAAI,SAAS;AAC5D,QAAI,iBAAiB;AACnB,aAAO;AAAA,IACT;AAGA,UAAM,iBAAiB,MAAK,qBAAqB,IAAI,SAAS;AAC9D,QAAI,gBAAgB;AAClB,aAAO;AAAA,IACT;AAEA,UAAM,IAAI;AAAA,MACR;AAAA,MACA,EAAE,MAAM,6HAA6H;AAAA,IACvI;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiCA,OAAc,iBAAsD,aAAsB;AACxF,WAAO,QAAQ,WAAW,EAAE,QAAQ,CAAC,CAAC,KAAK,YAAY,MAAM;AAC3D,YAAK,qBAAqB,IAAI,IAAI,YAAY,GAAG,YAAY;AAAA,IAC/D,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAc,yBAAmC;AAC/C,WAAO,MAAM,KAAK,MAAK,qBAAqB,KAAK,CAAC;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAyBA,OAAc,aACZ,QACe;AACf,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,OAAc,sBAA8B;AAC1C,eAAO,4BAAY,EAAE,EAAE,SAAS,KAAK;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoCA,OAAe,uBAA+B;AAC5C,eAAO,4BAAY,EAAE,EAAE,SAAS,KAAK;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA6CA,OAAe,mBAAmB,cAA8B;AAC9D,UAAM,OAAO,eAAAC,QACV,WAAW,QAAQ,EACnB,OAAO,YAAY,EACnB,OAAO,QAAQ;AAGlB,WAAO,KAAK,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAAA,EACvE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,MAAa,WAAW,UAAmD,OAAiC;AAC1G,UAAM,eAAe,OAAO,QAAQ,EAAE,YAAY;AAElD,SAAK,IAAI,QAAQ,QAAQ,8CAA8C,YAAY,EAAE;AAErF,UAAM,iBAAiB,KAAK,mBAAmB,YAAY;AAE3D,QAAI,CAAC,gBAAgB;AACnB,WAAK,IAAI,SAAS,QAAQ,aAAa,OAAO,QAAQ,CAAC,qBAAqB;AAC5E,YAAM,IAAI,2BAA2B,OAAO,QAAQ,GAAG;AAAA,QACrD,SAAS,aAAa,OAAO,QAAQ,CAAC;AAAA,MACxC,CAAC;AAAA,IACH;AAEA,UAAM,eAAe,KAAK,YAAY,cAAc,cAAc;AAGlE,QAAI;AACJ,QAAI;AAEJ,UAAM,kBAAkB,KAAK,aAAa,iBAAiB,KAAK,aAAa;AAC7E,QAAI,iBAAiB;AACnB,WAAK,IAAI,QAAQ,SAAS,8BAA8B;AACxD,YAAM,YAAY,MAAM,gBAAgB,YAAY;AACpD,mBAAa,SAAS,UAAU;AAChC,qBAAe,UAAU,KAAK;AAG9B,YAAM,UAAU,KAAK,aAAa,gBAAgB,KAAK,kBAAkB;AACzE,YAAM,QAAQ,UAAU,YAAY,UAAU,MAAM,GAAG;AAAA,IACzD,OAAO;AACL,WAAK,IAAI,QAAQ,SAAS,gCAAgC;AAC1D,mBAAa,aAAS,4BAAY,EAAE,EAAE,SAAS,KAAK;AACpD,yBAAe,4BAAY,EAAE,EAAE,SAAS,KAAK;AAG7C,YAAM,UAAU,KAAK,aAAa,gBAAgB,KAAK,kBAAkB;AACzE,YAAM,QAAQ;AAAA,QACZ;AAAA,QACA;AAAA,UACE,WAAW,KAAK,IAAI;AAAA,UACpB,UAAU;AAAA,UACV;AAAA,QACF;AAAA,QACA;AAAA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,gBAAgB,MAAK,mBAAmB,YAAY;AAE1D,SAAK,IAAI,QAAQ,SAAS,6BAA6B,YAAY,IAAI,EAAE,OAAO,WAAW,CAAC;AAE5F,UAAM,cAAc,KAAK;AAAA,MACvB;AAAA,MACA,eAAe;AAAA,MACf;AAAA,MACA,eAAe;AAAA,IACjB;AAEA,UAAM,SAAS,IAAI,gBAAgB;AAAA,MACjC,WAAW,eAAe;AAAA,MAC1B,cAAc,eAAe;AAAA,MAC7B,OAAO,YAAY,KAAK,GAAG;AAAA,MAC3B,OAAO;AAAA,MACP,eAAe;AAAA,MACf,gBAAgB;AAAA,MAChB,uBAAuB;AAAA,MACvB,GAAG,eAAe;AAAA,IACpB,CAAC;AAED,UAAM,UAAU,GAAG,aAAa,qBAAqB,IAAI,OAAO,SAAS,CAAC;AAC1E,SAAK,IAAI,QAAQ,QAAQ,4CAA4C;AAAA,MACnE,UAAU;AAAA,MACV,UAAU,aAAa;AAAA,IACzB,CAAC;AAED,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKQ,mBACN,cACA,kBACA,cACA,oBACU;AACV,QAAI,oBAAoB;AACtB,aAAO,oBAAoB,iBAAiB,SAAS,IACjD,mBACA,aAAa,cAAc,CAAC,UAAU,SAAS,SAAS;AAAA,IAC9D;AAEA,UAAM,oBAA8C;AAAA,MAClD,QAAQ,CAAC,UAAU,SAAS,SAAS;AAAA,MACrC,QAAQ,CAAC,aAAa,YAAY;AAAA,MAClC,WAAW,CAAC,UAAU,SAAS,SAAS;AAAA,IAC1C;AAEA,UAAM,sBAAsB;AAAA,MAC1B;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,UAAM,qBAAqB,oBAAI,IAAY;AAAA,MACzC,GAAG;AAAA,MACH,GAAI,aAAa,cAAc,CAAC;AAAA,MAChC,GAAI,kBAAkB,YAAY,KAAK,CAAC;AAAA,IAC1C,CAAC;AAED,UAAM,oBAAoB,oBAAoB,CAAC,GAAG,OAAO,CAAC,UAAU,mBAAmB,IAAI,KAAK,CAAC;AACjG,UAAM,kBAAkB,oBAAoB,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,mBAAmB,IAAI,KAAK,CAAC;AAEhG,QAAI,eAAe,SAAS,GAAG;AAC7B,WAAK;AAAA,QACH;AAAA,QACA;AAAA,QACA,oGAAoG,eAAe;AAAA,UACjH;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AAEA,QAAI,iBAAiB,SAAS,GAAG;AAC/B,aAAO;AAAA,IACT;AAEA,WAAO,aAAa,cAAc,kBAAkB,YAAY,KAAK,CAAC,UAAU,SAAS,SAAS;AAAA,EACpG;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,MAAa,eAAe;AAAA,IAC1B;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAIoB;AAClB,UAAM,eAAe,OAAO,QAAQ,EAAE,YAAY;AAClD,SAAK,IAAI,QAAQ,QAAQ,yCAAyC,YAAY,EAAE;AAEhF,QAAI,CAAC,QAAQ,KAAK,KAAK,MAAM,IAAI;AAC/B,WAAK,IAAI,SAAS,QAAQ,mDAAmD;AAC7E,YAAM,IAAI,0BAA0B,qCAAqC;AAAA,IAC3E;AAEA,QAAI,CAAC,SAAS,MAAM,KAAK,MAAM,IAAI;AACjC,WAAK,IAAI,SAAS,QAAQ,sCAAsC;AAChE,YAAM,IAAI,0BAA0B,sCAAsC;AAAA,IAC5E;AAEA,SAAK,IAAI,QAAQ,SAAS,8BAA8B,EAAE,MAAM,CAAC;AAGjE,UAAM,eAAe,KAAK,aAAa,gBAAgB,KAAK,kBAAkB;AAC9E,UAAM,cAAc,MAAM,aAAa,SAAS,KAAK;AACrD,QAAI,CAAC,aAAa;AAChB,WAAK,IAAI,SAAS,SAAS,uDAAuD,EAAE,MAAM,CAAC;AAC3F,YAAM,IAAI,kBAAkB,4BAA4B,EAAE,MAAM,CAAC;AAAA,IACnE;AAEA,SAAK,IAAI,QAAQ,SAAS,mDAAmD;AAE7E,UAAM,aAAa,YAAY,KAAK;AAGpC,UAAM,eAAe,YAAY;AAEjC,UAAM,iBAAiB,KAAK,mBAAmB,YAAY;AAE3D,QAAI,CAAC,gBAAgB;AACnB,WAAK,IAAI,SAAS,QAAQ,aAAa,OAAO,QAAQ,CAAC,qBAAqB;AAC5E,YAAM,IAAI,2BAA2B,OAAO,QAAQ,GAAG;AAAA,QACrD,SAAS,aAAa,OAAO,QAAQ,CAAC;AAAA,MACxC,CAAC;AAAA,IACH;AAEA,UAAM,eAAe,KAAK,YAAY,cAAc,cAAc;AAElE,SAAK,IAAI,QAAQ,SAAS,4CAA4C,EAAE,UAAU,aAAa,CAAC;AAGhG,UAAM,SAAS,MAAM,KAAK;AAAA,MACxB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,SAAK,IAAI,QAAQ,SAAS,2BAA2B;AACrD,SAAK,IAAI,QAAQ,WAAW,yBAAyB;AAGrD,UAAM,mBAAqC;AAAA,MACzC,MAAM;AAAA,MACN,WAAW;AAAA,QACT,eAAe,aAAa;AAAA,QAC5B,OAAO,aAAa;AAAA,QACpB,UAAU,aAAa;AAAA,MACzB;AAAA,IACF;AAGA,QAAI;AACJ,QAAI;AACF,YAAM,EAAE,SAAS,IAAI,MAAM,gBAAgB,QAAQ,gBAAgB;AACnE,0BAAoB;AAAA,IACtB,QAAQ;AAAA,IAER;AAGA,UAAM,kBACJ,KAAK,eAAe,mBACpB,KAAK,eAAe,oBACnB,KAAK,oBAAoB,kBAAkB,KAAK,oBAAoB,gBAAgB,KAAK,KAAK,mBAAmB,IAAI;AAExH,QAAI,CAAC,iBAAiB;AACpB,YAAM,IAAI,MAAM,yCAAyC;AAAA,IAC3D;AAEA,QAAI,KAAK,eAAe,mBAAmB,KAAK,eAAe,iBAAiB;AAC9E,WAAK,IAAI,QAAQ,WAAW,gCAAgC;AAAA,IAC9D,OAAO;AACL,WAAK,IAAI,QAAQ,WAAW,kCAAkC;AAAA,IAChE;AAEA,UAAM,UAAU,MAAM,gBAAgB,QAAQ,gBAAgB;AAC9D,YAAQ,WAAW,QAAQ,YAAY;AACvC,QAAI,mBAAmB,SAAS,CAAC,QAAQ,OAAO;AAC9C,cAAQ,QAAQ,kBAAkB;AAAA,IACpC;AAEA,UAAM,iBAAiB,KAAK,eAAe,kBAAkB,KAAK,oBAAoB;AAGtF,UAAM,gBAAgB,KAAK,OAAO;AAClC,UAAM,OAAO,OAAO,eAAe,QAAQ,EAAE;AAC7C,UAAM,gBACJ,4EACA,SAAS,iCACT,SAAS;AACX,UAAM,QAAQ,mBAAmB;AACjC,UAAM,aAAa,mBAAmB,mBAAmB;AACzD,UAAM,kBAAkB,eAAe,wBAAwB;AAC/D,UAAM,UAAU,iBAAiB,UAAU,CAAC,mBAAmB;AAE/D,QAAI,WAAW,eAAe,mBAAmB;AAC/C,YAAM,iBAAiB,MAAM,eAAe,kBAAkB,KAAK;AACnE,UAAI,gBAAgB;AAClB,aAAK,IAAI,QAAQ,kBAAkB,qBAAqB,YAAY,oCAAoC,KAAK,GAAG;AAChH,cAAM,EAAE,WAAW,mBAAmB,SAAS,gBAAgB,IAAI;AAEnE,wBAAgB,WAAW,gBAAgB,YAAY,CAAC;AACxD,wBAAgB,SAAS,YAAY,IAAI;AAAA,UACvC,UAAU;AAAA,UACV,gBAAgB,mBAAmB,OAAO,mBAAmB;AAAA,UAC7D;AAAA,UACA,aAAa,OAAO;AAAA,UACpB,KAAK;AAAA,UACL,UAAU,KAAK,IAAI;AAAA,QACrB;AACA,wBAAgB,WAAW;AAC3B,wBAAgB,QAAQ,OAAO;AAC/B,wBAAgB,MAAM;AAEtB,cAAM,eAAe,YAAY,mBAAmB,iBAAiB,KAAK;AAC1E,eAAO;AAAA,MACT;AAAA,IACF;AAGA,YAAQ,WAAW,QAAQ,YAAY,CAAC;AACxC,YAAQ,SAAS,YAAY,IAAI;AAAA,MAC/B,UAAU;AAAA,MACV,gBAAgB,mBAAmB,OAAO,mBAAmB;AAAA,MAC7D,OAAO,mBAAmB;AAAA,MAC1B,aAAa,OAAO;AAAA,MACpB,KAAK;AAAA,MACL,UAAU,KAAK,IAAI;AAAA,IACrB;AAGA,UAAM,gBAAY,4BAAY,EAAE,EAAE,SAAS,KAAK;AAChD,YAAQ,KAAK;AAEb,SAAK,IAAI,QAAQ,WAAW,mBAAmB,EAAE,UAAU,CAAC;AAC5D,UAAM,eAAe,YAAY,WAAW,SAAS,KAAK;AAE1D,SAAK,IAAI,QAAQ,WAAW,gCAAgC,EAAE,UAAU,CAAC;AAEzE,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAa,YAAY,QAKL;AAClB,UAAM,EAAE,WAAW,UAAU,MAAM,MAAM,IAAI;AAC7C,UAAM,iBAAiB,KAAK,eAAe,kBAAkB,KAAK,oBAAoB;AACtF,UAAM,kBAAkB,MAAM,eAAe,WAAW,SAAS;AAEjE,QAAI,CAAC,iBAAiB;AACpB,YAAM,IAAI,qBAAqB,sEAAsE,EAAE,UAAU,CAAC;AAAA,IACpH;AAEA,QAAI,CAAC,QAAQ,KAAK,KAAK,MAAM,IAAI;AAC/B,YAAM,IAAI,0BAA0B,wCAAwC;AAAA,IAC9E;AAEA,UAAM,eAAe,OAAO,QAAQ,EAAE,YAAY;AAClD,UAAM,iBAAiB,KAAK,mBAAmB,YAAY;AAC3D,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,2BAA2B,OAAO,QAAQ,CAAC;AAAA,IACvD;AACA,UAAM,eAAe,KAAK,YAAY,cAAc,cAAc;AAGlE,QAAI;AACJ,QAAI,OAAO;AACT,YAAM,eAAe,KAAK,aAAa,gBAAgB,KAAK,kBAAkB;AAC9E,YAAM,cAAc,MAAM,aAAa,SAAS,KAAK;AACrD,UAAI,CAAC,aAAa;AAChB,cAAM,IAAI,kBAAkB,mDAAmD,EAAE,MAAM,CAAC;AAAA,MAC1F;AACA,qBAAe,YAAY;AAC3B,YAAM,aAAa,YAAY,KAAK;AAAA,IACtC;AAGA,UAAM,SAAS,MAAM,KAAK,qBAAqB,MAAM,gBAAgB,cAAc,gBAAgB,EAAE;AAErG,UAAM,mBAAqC;AAAA,MACzC,MAAM;AAAA,MACN,WAAW;AAAA,QACT,eAAe,aAAa;AAAA,QAC5B,OAAO,aAAa;AAAA,QACpB,UAAU,aAAa;AAAA,MACzB;AAAA,IACF;AAEA,QAAI;AACJ,QAAI;AACF,YAAM,EAAE,SAAS,IAAI,MAAM,gBAAgB,QAAQ,gBAAgB;AACnE,0BAAoB;AAAA,IACtB,QAAQ;AAAA,IAER;AAEA,oBAAgB,WAAW,gBAAgB,YAAY,CAAC;AACxD,oBAAgB,SAAS,YAAY,IAAI;AAAA,MACvC,UAAU;AAAA,MACV,gBAAgB,mBAAmB,OAAO,mBAAmB;AAAA,MAC7D,OAAO,mBAAmB;AAAA,MAC1B,aAAa,OAAO;AAAA,MACpB,KAAK;AAAA,MACL,UAAU,KAAK,IAAI;AAAA,IACrB;AAEA,QAAI,mBAAmB,SAAS,CAAC,gBAAgB,OAAO;AACtD,sBAAgB,QAAQ,kBAAkB;AAAA,IAC5C;AAEA,UAAM,eAAe,YAAY,WAAW,iBAAiB,KAAK;AAClE,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAa,cAAc,WAAmB,kBAA4C;AACxF,UAAM,iBAAiB,KAAK,eAAe,kBAAkB,KAAK,oBAAoB;AACtF,UAAM,UAAU,MAAM,eAAe,WAAW,SAAS;AAEzD,QAAI,CAAC,WAAW,CAAC,QAAQ,UAAU;AACjC,YAAM,IAAI,mBAAmB,gDAAgD,EAAE,UAAU,CAAC;AAAA,IAC5F;AAEA,UAAM,kBAAkB,OAAO,KAAK,QAAQ,QAAQ;AACpD,QAAI,gBAAgB,UAAU,GAAG;AAC/B,YAAM,IAAI,mBAAmB,oEAAoE;AAAA,QAC/F;AAAA,QACA,UAAU;AAAA,MACZ,CAAC;AAAA,IACH;AAEA,WAAO,QAAQ,SAAS,iBAAiB,YAAY,CAAC;AACtD,UAAM,eAAe,YAAY,WAAW,SAAS,KAAK;AAC1D,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAa,mBAAmB,QAOZ;AAClB,UAAM,EAAE,WAAW,UAAU,QAAQ,OAAO,QAAQ,YAAY,IAAI;AACpE,UAAM,iBAAiB,KAAK,eAAe,kBAAkB,KAAK,oBAAoB;AACtF,UAAM,gBAAgB,MAAM,eAAe,WAAW,SAAS;AAE/D,QAAI,CAAC,eAAe;AAClB,YAAM,IAAI,qBAAqB,qFAAqF,EAAE,UAAU,CAAC;AAAA,IACnI;AAEA,UAAM,eAAe,OAAO,QAAQ,EAAE,YAAY;AAClD,UAAM,iBAAiB,KAAK,mBAAmB,YAAY;AAC3D,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,2BAA2B,OAAO,QAAQ,CAAC;AAAA,IACvD;AAEA,UAAM,eAAe,KAAK,YAAY,cAAc,cAAc;AAClE,UAAM,aAAa,aAAS,4BAAY,EAAE,EAAE,SAAS,KAAK;AAC1D,UAAM,mBAAe,4BAAY,EAAE,EAAE,SAAS,KAAK;AAEnD,UAAM,UAAU,KAAK,aAAa,gBAAgB,KAAK,kBAAkB;AACzE,UAAM,QAAQ;AAAA,MACZ;AAAA,MACA;AAAA,QACE,WAAW,KAAK,IAAI;AAAA,QACpB,UAAU;AAAA,QACV;AAAA,MACF;AAAA,MACA;AAAA,IACF;AAEA,UAAM,gBAAgB,MAAK,mBAAmB,YAAY;AAE1D,UAAM,eAAe,IAAI,gBAAgB;AAAA,MACvC,WAAW,eAAe;AAAA,MAC1B,cAAc,eAAe;AAAA,MAC7B,OAAO,OAAO,KAAK,GAAG;AAAA,MACtB,OAAO;AAAA,MACP,eAAe;AAAA,MACf,gBAAgB;AAAA,MAChB,uBAAuB;AAAA,MACvB,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,MAC3B,GAAG,eAAe;AAAA,MAClB,GAAG;AAAA,IACL,CAAC;AAED,WAAO,GAAG,aAAa,qBAAqB,IAAI,aAAa,SAAS,CAAC;AAAA,EACzE;AAAA,EAEQ,sBAAsB,SAA0B;AACtD,WAAO,QAAQ,UAAU,QAAQ,SAAS,QAAQ,MAAM;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA,EAKA,MAAa,uBAAuB,QAMf;AACnB,UAAM,EAAE,WAAW,UAAU,MAAM,OAAO,OAAO,IAAI;AACrD,UAAM,iBAAiB,KAAK,eAAe,kBAAkB,KAAK,oBAAoB;AACtF,UAAM,gBAAgB,MAAM,eAAe,WAAW,SAAS;AAE/D,QAAI,CAAC,eAAe;AAClB,YAAM,IAAI,qBAAqB,8EAA8E,EAAE,UAAU,CAAC;AAAA,IAC5H;AAEA,UAAM,eAAe,OAAO,QAAQ,EAAE,YAAY;AAClD,UAAM,iBAAiB,KAAK,mBAAmB,YAAY;AAC3D,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,2BAA2B,OAAO,QAAQ,CAAC;AAAA,IACvD;AACA,UAAM,eAAe,KAAK,YAAY,cAAc,cAAc;AAElE,QAAI,mBAAe,4BAAY,EAAE,EAAE,SAAS,KAAK;AACjD,QAAI,OAAO;AACT,YAAM,eAAe,KAAK,aAAa,gBAAgB,KAAK,kBAAkB;AAC9E,YAAM,cAAc,MAAM,aAAa,SAAS,KAAK;AACrD,UAAI,CAAC,aAAa;AAChB,cAAM,IAAI,kBAAkB,gEAAgE,EAAE,MAAM,CAAC;AAAA,MACvG;AACA,qBAAe,YAAY;AAC3B,YAAM,aAAa,YAAY,KAAK;AAAA,IACtC;AAEA,UAAM,SAAS,MAAM,KAAK,qBAAqB,MAAM,gBAAgB,cAAc,YAAY;AAC/F,UAAM,YAAY,OAAO,aAAa,KAAK,IAAI,IAAI,OAAO,aAAa,MAAO;AAE9E,UAAM,oBAAuC;AAAA,MAC3C,UAAU;AAAA,MACV,aAAa,OAAO;AAAA,MACpB,cAAc,OAAO;AAAA,MACrB;AAAA,MACA,QAAQ,WAAW,OAAO,QAAQ,OAAO,MAAM,MAAM,GAAG,IAAI,CAAC;AAAA,MAC7D,KAAK;AAAA,MACL,aAAa,KAAK,IAAI;AAAA,IACxB;AAGA,UAAM,UAAU,KAAK,sBAAsB,aAAa;AACxD,UAAM,kBAAkB,KAAK,gBAAgB,mBAAmB,KAAK,qBAAqB;AAC1F,UAAM,gBAAgB,aAAa,SAAS,cAAc,iBAAiB;AAG3E,kBAAc,YAAY,cAAc,aAAa,CAAC;AACtD,kBAAc,UAAU,YAAY,IAAI;AACxC,UAAM,eAAe,YAAY,WAAW,eAAe,KAAK;AAEhE,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAa,gBAAgB,eAAuB,UAAqD;AACvG,UAAM,kBAAkB,KAAK,gBAAgB,mBAAmB,KAAK,qBAAqB;AAC1F,UAAM,eAAe,SAAS,YAAY;AAC1C,UAAM,WAAW,MAAM,gBAAgB,YAAY,eAAe,YAAY;AAC9E,QAAI,CAAC,SAAU,QAAO;AAGtB,QAAI,SAAS,gBAAgB,SAAS,aAAa,KAAK,IAAI,KAAK,SAAS,YAAY,KAAO;AAC3F,WAAK,IAAI,QAAQ,SAAS,mCAAmC,aAAa,SAAS,YAAY,kCAAkC;AACjI,UAAI;AACF,eAAO,MAAM,KAAK,yBAAyB,eAAe,YAAY;AAAA,MACxE,SAAS,OAAO;AACd,aAAK,IAAI,SAAS,SAAS,mDAAmD,aAAa,SAAS,YAAY,KAAK,EAAE,OAAO,OAAO,KAAK,EAAE,CAAC;AAAA,MAC/I;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAa,iBAAiB,eAAmE;AAC/F,UAAM,kBAAkB,KAAK,gBAAgB,mBAAmB,KAAK,qBAAqB;AAC1F,WAAO,MAAM,gBAAgB,iBAAiB,aAAa;AAAA,EAC7D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAa,qBAAqB,WAAmB,UAAqD;AACxG,UAAM,iBAAiB,KAAK,eAAe,kBAAkB,KAAK,oBAAoB;AACtF,UAAM,gBAAgB,MAAM,eAAe,WAAW,SAAS;AAC/D,QAAI,CAAC,cAAe,QAAO;AAE3B,UAAM,eAAe,SAAS,YAAY;AAC1C,UAAM,UAAU,KAAK,sBAAsB,aAAa;AAGxD,QAAI,WAAW,MAAM,KAAK,gBAAgB,SAAS,YAAY;AAG/D,QAAI,CAAC,YAAY,cAAc,WAAW;AACxC,iBAAW,cAAc,UAAU,YAAY,KAAK;AAAA,IACtD;AAEA,QAAI,UAAU;AAEZ,UAAI,SAAS,gBAAgB,SAAS,aAAa,KAAK,IAAI,KAAK,SAAS,YAAY,KAAO;AAC3F,aAAK,IAAI,QAAQ,SAAS,mCAAmC,OAAO,SAAS,YAAY,kCAAkC;AAC3H,YAAI;AACF,qBAAW,MAAM,KAAK,qBAAqB,WAAW,YAAY;AAAA,QACpE,SAAS,OAAO;AACd,eAAK,IAAI,SAAS,SAAS,mDAAmD,OAAO,SAAS,YAAY,KAAK,EAAE,OAAO,OAAO,KAAK,EAAE,CAAC;AAAA,QACzI;AAAA,MACF;AAEA,oBAAc,YAAY,cAAc,aAAa,CAAC;AACtD,oBAAc,UAAU,YAAY,IAAI;AAAA,IAC1C;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAa,yBACX,eACA,UACA,kBAC4B;AAC5B,UAAM,WAAW,GAAG,cAAc,YAAY,CAAC,IAAI,SAAS,YAAY,CAAC;AACzE,UAAM,kBAAkB,KAAK,eAAe,IAAI,QAAQ;AACxD,QAAI,iBAAiB;AACnB,WAAK,IAAI,QAAQ,SAAS,4CAA4C,QAAQ,+BAA+B;AAC7G,aAAO;AAAA,IACT;AAEA,UAAM,iBAAiB,KAAK,gCAAgC,eAAe,UAAU,gBAAgB,EAClG,QAAQ,MAAM;AACb,WAAK,eAAe,OAAO,QAAQ;AAAA,IACrC,CAAC;AAEH,SAAK,eAAe,IAAI,UAAU,cAAc;AAChD,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,gCACZ,eACA,UACA,kBAC4B;AAC5B,UAAM,kBAAkB,KAAK,gBAAgB,mBAAmB,KAAK,qBAAqB;AAC1F,UAAM,eAAe,SAAS,YAAY;AAC1C,QAAI,WAAW,oBAAqB,MAAM,gBAAgB,YAAY,eAAe,YAAY;AAEjG,QAAI,CAAC,YAAY,CAAC,SAAS,cAAc;AACvC,YAAM,IAAI;AAAA,QACR,wCAAwC,aAAa,4BAA4B,QAAQ;AAAA,QACzF,EAAE,QAAQ,eAAe,SAAS;AAAA,MACpC;AAAA,IACF;AAEA,UAAM,iBAAiB,KAAK,mBAAmB,YAAY;AAC3D,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,2BAA2B,QAAQ;AAAA,IAC/C;AACA,UAAM,eAAe,KAAK,YAAY,cAAc,cAAc;AAElE,UAAM,OAA+B;AAAA,MACnC,WAAW,eAAe;AAAA,MAC1B,eAAe,eAAe;AAAA,MAC9B,YAAY;AAAA,MACZ,eAAe,SAAS;AAAA,IAC1B;AAEA,UAAM,WAAW,MAAM,MAAM,aAAa,eAAe;AAAA,MACvD,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,QAAQ;AAAA,MACV;AAAA,MACA,MAAM,IAAI,gBAAgB,IAAI,EAAE,SAAS;AAAA,IAC3C,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,YAAY,MAAM,SAAS,KAAK;AACtC,YAAM,IAAI;AAAA,QACR,8CAA8C,aAAa,SAAS,QAAQ,MAAM,SAAS,MAAM,MAAM,SAAS;AAAA,QAChH,EAAE,QAAQ,eAAe,UAAU,QAAQ,SAAS,OAAO;AAAA,MAC7D;AAAA,IACF;AAEA,UAAM,SAA6B,MAAM,SAAS,KAAK;AACvD,UAAM,YAAY,OAAO,aAAa,KAAK,IAAI,IAAI,OAAO,aAAa,MAAO;AAE9E,aAAS,cAAc,OAAO;AAC9B,QAAI,OAAO,eAAe;AACxB,eAAS,eAAe,OAAO;AAAA,IACjC;AACA,QAAI,WAAW;AACb,eAAS,YAAY;AAAA,IACvB;AACA,aAAS,MAAM;AACf,aAAS,cAAc,KAAK,IAAI;AAEhC,UAAM,gBAAgB,aAAa,eAAe,cAAc,QAAQ;AACxE,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAa,qBAAqB,WAAmB,UAA8C;AACjG,UAAM,iBAAiB,KAAK,eAAe,kBAAkB,KAAK,oBAAoB;AACtF,UAAM,gBAAgB,MAAM,eAAe,WAAW,SAAS;AAC/D,QAAI,CAAC,eAAe;AAClB,YAAM,IAAI,qBAAqB,6BAA6B,EAAE,UAAU,CAAC;AAAA,IAC3E;AACA,UAAM,eAAe,SAAS,YAAY;AAC1C,UAAM,UAAU,KAAK,sBAAsB,aAAa;AACxD,UAAM,mBAAmB,cAAc,YAAY,cAAc,UAAU,YAAY,IAAI;AAE3F,UAAM,YAAY,MAAM,KAAK,yBAAyB,SAAS,cAAc,gBAAgB;AAC7F,kBAAc,YAAY,cAAc,aAAa,CAAC;AACtD,kBAAc,UAAU,YAAY,IAAI;AACxC,UAAM,eAAe,YAAY,WAAW,eAAe,KAAK;AAChE,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAa,uBAAuB,eAAuB,UAAoC;AAC7F,UAAM,kBAAkB,KAAK,gBAAgB,mBAAmB,KAAK,qBAAqB;AAC1F,UAAM,gBAAgB,eAAe,eAAe,SAAS,YAAY,CAAC;AAC1E,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAa,mBAAmB,WAAmB,UAAoC;AACrF,UAAM,iBAAiB,KAAK,eAAe,kBAAkB,KAAK,oBAAoB;AACtF,UAAM,gBAAgB,MAAM,eAAe,WAAW,SAAS;AAC/D,QAAI,eAAe;AACjB,YAAM,UAAU,KAAK,sBAAsB,aAAa;AACxD,YAAM,KAAK,uBAAuB,SAAS,QAAQ;AACnD,UAAI,cAAc,WAAW;AAC3B,eAAO,cAAc,UAAU,SAAS,YAAY,CAAC;AACrD,cAAM,eAAe,YAAY,WAAW,eAAe,KAAK;AAAA,MAClE;AACA,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAa,iBAAiB,WAA4C;AACxE,UAAM,iBAAiB,KAAK,eAAe,kBAAkB,KAAK,oBAAoB;AACtF,WAAO,MAAM,eAAe,WAAoB,SAAS;AAAA,EAC3D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAa,cAAc,WAAkC;AAC3D,UAAM,iBAAiB,KAAK,eAAe,kBAAkB,KAAK,oBAAoB;AACtF,UAAM,eAAe,cAAc,SAAS;AAAA,EAC9C;AAAA,EAEA,MAAc,qBACZ,MACA,gBACA,cACA,cAC6B;AAE7B,UAAM,OAA+B;AAAA,MACnC,WAAW,eAAe;AAAA,MAC1B,eAAe,eAAe;AAAA,MAC9B;AAAA,MACA,cAAc,eAAe;AAAA,MAC7B,YAAY;AAAA,IACd;AAEA,QAAI,cAAc;AAChB,WAAK,gBAAgB;AAAA,IACvB;AACA,UAAM,SAAS,IAAI,gBAAgB,IAAI;AAEvC,SAAK,IAAI,QAAQ,SAAS,kCAAkC;AAAA,MAC1D,UAAU,aAAa;AAAA,IACzB,CAAC;AAED,UAAM,WAAW,MAAM,MAAM,aAAa,eAAe;AAAA,MACvD,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,QAAQ;AAAA,MACV;AAAA,MACA,MAAM,OAAO,SAAS;AAAA,IACxB,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,YAAY,MAAM,SAAS,KAAK;AACtC,WAAK,IAAI,SAAS,SAAS,yBAAyB;AAAA,QAClD,QAAQ,SAAS;AAAA,QACjB,YAAY,SAAS;AAAA,QACrB,OAAO;AAAA,MACT,CAAC;AACD,YAAM,IAAI;AAAA,QACR,0BAA0B,SAAS,MAAM,IAAI,SAAS,UAAU,MAAM,SAAS;AAAA,QAC/E,SAAS;AAAA,QACT,EAAE,YAAY,SAAS,YAAY,UAAU;AAAA,MAC/C;AAAA,IACF;AAEA,SAAK,IAAI,QAAQ,SAAS,+CAA+C;AACzE,WAAO,SAAS,KAAK;AAAA,EACvB;AAAA,EAEQ,mBAAmB,cAAkD;AAE3E,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,OAAO,SAAS,GAAG;AAChE,UAAI,IAAI,YAAY,MAAM,aAAa,YAAY,GAAG;AACpD,eAAO;AAAA,MACT;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;;;AMpyCO,IAAM,8BAA8B;AAMpC,IAAM,4BAA4B;AAMlC,IAAM,kCAAkC,KAAK,KAAK;AAMlD,IAAM,gCAAgC,IAAI;AAM1C,SAAS,0BAAmC;AACjD,SAAO,OAAO,YAAY,eAAe,QAAQ,KAAK,aAAa;AACrE;AAYO,SAAS,gBAAgB,MAAc,OAAe,SAAiC;AAC5F,QAAM,SAAS,wBAAwB;AACvC,QAAM,OAAO,SAAS,QAAQ;AAC9B,QAAM,WAAW,SAAS,YAAY;AACtC,QAAM,SAAS,SAAS,UAAU;AAClC,QAAM,WAAW,SAAS,YAAY;AAEtC,QAAM,QAAkB,CAAC,GAAG,mBAAmB,IAAI,CAAC,IAAI,mBAAmB,KAAK,CAAC,EAAE;AAEnF,MAAI,MAAM;AACR,UAAM,KAAK,QAAQ,IAAI,EAAE;AAAA,EAC3B;AAEA,MAAI,OAAO,SAAS,WAAW,UAAU;AACvC,UAAM,KAAK,WAAW,KAAK,MAAM,QAAQ,MAAM,CAAC,EAAE;AAElD,UAAM,UAAU,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,SAAS,GAAI,EAAE,YAAY;AACzE,UAAM,KAAK,WAAW,OAAO,EAAE;AAAA,EACjC;AAEA,MAAI,SAAS,QAAQ;AACnB,UAAM,KAAK,UAAU,QAAQ,MAAM,EAAE;AAAA,EACvC;AAEA,MAAI,UAAU;AACZ,UAAM,KAAK,UAAU;AAAA,EACvB;AAEA,MAAI,QAAQ;AACV,UAAM,KAAK,QAAQ;AAAA,EACrB;AAEA,MAAI,UAAU;AACZ,UAAM,cAAc,SAAS,OAAO,CAAC,EAAE,YAAY,IAAI,SAAS,MAAM,CAAC,EAAE,YAAY;AACrF,UAAM,KAAK,YAAY,WAAW,EAAE;AAAA,EACtC;AAEA,SAAO,MAAM,KAAK,IAAI;AACxB;AAkBO,SAAS,oBAAoB,WAAmB,SAAwC;AAC7F,QAAM,SAAS,wBAAwB;AACvC,QAAM,kBAAiC;AAAA,IACrC,MAAM,SAAS,QAAQ;AAAA,IACvB,MAAM,SAAS,QAAQ;AAAA,IACvB,QAAQ,SAAS,UAAU;AAAA,IAC3B,UAAU,SAAS,YAAY;AAAA,IAC/B,QAAQ,SAAS,UAAU;AAAA,IAC3B,UAAU,SAAS,YAAY;AAAA,IAC/B,QAAQ,SAAS;AAAA,EACnB;AAEA,QAAM,OAAO,gBAAgB;AAC7B,QAAM,SAAS,gBAAgB,MAAM,WAAW,eAAe;AAE/D,SAAO;AAAA,IACL;AAAA,IACA,OAAO;AAAA,IACP,SAAS;AAAA,IACT;AAAA,EACF;AACF;AAiBO,SAAS,mBAAmB,SAAwC;AACzE,QAAM,SAAS,wBAAwB;AACvC,QAAM,kBAAiC;AAAA,IACrC,MAAM,SAAS,QAAQ;AAAA,IACvB,MAAM,SAAS,QAAQ;AAAA,IACvB,QAAQ;AAAA,IACR,UAAU,SAAS,YAAY;AAAA,IAC/B,QAAQ,SAAS,UAAU;AAAA,IAC3B,UAAU,SAAS,YAAY;AAAA,IAC/B,QAAQ,SAAS;AAAA,EACnB;AAEA,QAAM,OAAO,gBAAgB;AAC7B,QAAM,SAAS,gBAAgB,MAAM,IAAI,eAAe;AAExD,SAAO;AAAA,IACL;AAAA,IACA,OAAO;AAAA,IACP,SAAS;AAAA,IACT;AAAA,EACF;AACF;AAUO,SAAS,kBAAkB,OAAe,SAAwC;AACvF,QAAM,SAAS,wBAAwB;AACvC,QAAM,kBAAiC;AAAA,IACrC,MAAM,SAAS,QAAQ;AAAA,IACvB,MAAM,SAAS,QAAQ;AAAA,IACvB,QAAQ,SAAS,UAAU;AAAA,IAC3B,UAAU,SAAS,YAAY;AAAA,IAC/B,QAAQ,SAAS,UAAU;AAAA,IAC3B,UAAU,SAAS,YAAY;AAAA,IAC/B,QAAQ,SAAS;AAAA,EACnB;AAEA,QAAM,OAAO,gBAAgB;AAC7B,QAAM,SAAS,gBAAgB,MAAM,OAAO,eAAe;AAE3D,SAAO;AAAA,IACL;AAAA,IACA,OAAO;AAAA,IACP,SAAS;AAAA,IACT;AAAA,EACF;AACF;AASO,SAAS,iBAAiB,SAAwC;AACvE,QAAM,SAAS,wBAAwB;AACvC,QAAM,kBAAiC;AAAA,IACrC,MAAM,SAAS,QAAQ;AAAA,IACvB,MAAM,SAAS,QAAQ;AAAA,IACvB,QAAQ;AAAA,IACR,UAAU,SAAS,YAAY;AAAA,IAC/B,QAAQ,SAAS,UAAU;AAAA,IAC3B,UAAU,SAAS,YAAY;AAAA,IAC/B,QAAQ,SAAS;AAAA,EACnB;AAEA,QAAM,OAAO,gBAAgB;AAC7B,QAAM,SAAS,gBAAgB,MAAM,IAAI,eAAe;AAExD,SAAO;AAAA,IACL;AAAA,IACA,OAAO;AAAA,IACP,SAAS;AAAA,IACT;AAAA,EACF;AACF;","names":["import_crypto","AccountLinkingStrategy","NodeCache","import_crypto","import_node_cache","NodeCache","crypto"]}